CVE-2023-39796

CRITICAL EXPLOITED NUCLEI

WBCE CMS 1.6.0 - Unauthenticated SQL Injection via DB_RECORD_TABLE Parameter

Title source: llm

Exploitation Summary

CVE-2023-39796 has been observed exploited in the wild (reported by VulnCheck KEV). A Nuclei detection template is also available.

Description

SQL injection vulnerability in the miniform module in WBCE CMS v.1.6.0 allows remote unauthenticated attacker to execute arbitrary code via the DB_RECORD_TABLE parameter.

Nuclei Templates (1)

WBCE 1.6.0 - SQL Injection

CRITICALVERIFIEDby youngpope

References (3)

Core 3

Core References

Issue Tracking

https://forum.wbce.org/viewtopic.php?pid=42046#p42046

Release Notes

https://github.com/WBCE/WBCE_CMS/releases/tag/1.6.1

Third Party Advisory

https://pastebin.com/PBw5AvGp

Scores

CVSS v3 9.8

EPSS 0.0610

EPSS Percentile 92.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

VulnCheck KEV 2024-06-19

CWE

CWE-89

Status published

Products (1)

wbce/wbce_cms 1.6.0

Published Nov 10, 2023

Tracked Since Feb 18, 2026