Cross-Site Scripting Vulnerability in Wolf CMS by WolfCMS
CVE-2018-6890

4.8MEDIUM

Key Information:

Vendor

Wolfcms

Status
Wolf Cms
Vendor
CVE Published:
22 February 2018

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2018-6890?

A Cross-Site Scripting (XSS) vulnerability exists in Wolf CMS version 0.8.3.1, allowing attackers to inject malicious scripts via the page editing feature. This can lead to unauthorized actions performed on behalf of the user and can potentially compromise sensitive user data. The vulnerability can be triggered by manipulating the admin page edit URL. It is crucial for users of this version to apply the necessary security updates.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

WolfCMS-XSS-POC
Created by pradeepjairamani

References

https://github.com/pradeepjairamani/WolfCMS-XSS-POC/blob/...
x_refsource_MISC
https://github.com/pradeepjairamani/WolfCMS-XSS-POC
x_refsource_MISC

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability Reserved

.