CVE-2017-14521

HIGH

WonderCMS 2.3.1 - Unrestricted Upload of File with Dangerous Type

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2017-14521. PoCs published by Samrat Das.

AI-analyzed exploit summary This exploit demonstrates an arbitrary file upload vulnerability in WonderCMS, allowing authenticated users to upload a PHP shell and execute system commands via a GET parameter. The vulnerability arises from insufficient file type validation.

Description

In WonderCMS 2.3.1, the upload functionality accepts random application extensions and leads to malicious File Upload.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Samrat Das · textwebappsphp

https://www.exploit-db.com/exploits/43963

View Code ZIP pw:eip

This exploit demonstrates an arbitrary file upload vulnerability in WonderCMS, allowing authenticated users to upload a PHP shell and execute system commands via a GET parameter. The vulnerability arises from insufficient file type validation.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: WonderCMS (version not specified)

Auth required

Prerequisites: Valid credentials for WonderCMS · Access to the file upload functionality

MITRE ATT&CK

T1105 - Ingress Tool Transfer T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2

Core References

Exploit, Technical Description, Third Party Advisory x_refsource_misc

https://securitywarrior9.blogspot.in/2018/01/vulnerability-in-wonder-cms-leading-to.html

Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db

https://www.exploit-db.com/exploits/43963/

Scores

CVSS v3 8.8

EPSS 0.0744

EPSS Percentile 93.7%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-434

Status published

Products (2)

wondercms/wondercms 2.3.0

wondercms/wondercms 2.3.1

Published Jan 26, 2018

Tracked Since Feb 18, 2026