CVE-2024-27563

MEDIUM

WonderCMS 3.1.3 - Server-Side Request Forgery via PluginThemeUrl Parameter

Title source: llm

Description

A Server-Side Request Forgery (SSRF) in the getFileFromRepo function of WonderCMS v3.1.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the pluginThemeUrl parameter.

References (1)

Core 1

Core References

Exploit, Third Party Advisory

https://github.com/zer0yu/CVE_Request/blob/master/WonderCMS/wondercms_pluginThemeUrl.md

View Exploit ZIP pw:eip

Scores

CVSS v3 5.3

EPSS 0.0042

EPSS Percentile 33.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-918

Status published

Products (1)

wondercms/wondercms 3.1.3

Published Mar 05, 2024

Tracked Since Feb 18, 2026