CVE-2023-39796

CRITICALNuclei

wbce wbce_cms Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2023-39796 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

SQL injection vulnerability in the miniform module in WBCE CMS v.1.6.0 allows remote unauthenticated attacker to execute arbitrary code via the DB_RECORD_TABLE parameter.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jun 19, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 3, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

wbce_cms

Browse wbce / wbce_cms
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALWBCE 1.6.0 - SQL InjectionCVSS 9.8

There is an sql injection vulnerability in "miniform module" which is a default module installed in the WBCE cms. It is an unauthenticated sqli so anyone could access it and takeover the whole database. In file "/modules/miniform/ajax_delete_message.php" there is no authentication check. On line 40 in this file, there is a DELETE query that is vulnerable, an attacker could jump from the query using the tick sign - `.

Impact

Unauthenticated attackers can execute time-based SQL injection through the DB_RECORD_TABLE parameter in the miniform module to extract the complete CMS database and takeover the WBCE installation.

Remediation

Fixed in version 1.6.1

WeaknessesCWE-89
Authorsyoungpope
Template tagstime-based-sqlicvecve2023sqliwbceintrusivevkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:wbce:wbce_cms:1.6.0:*:*:*:*:*:*:*
https://forum.wbce.org/viewtopic.php?pid=42046#p42046 https://github.com/WBCE/WBCE_CMS/releases/tag/1.6.1 https://pastebin.com/PBw5AvGp

Source: ProjectDiscovery

References

4