Listen to this Post
How the CVE Works
The vulnerability in WCMS 11 stems from improper input sanitization in the `AnonymousController.php` file, specifically within the `mobile_phone` parameter. Attackers can craft malicious SQL queries through this parameter, leading to unauthorized database access. The flaw allows remote exploitation without authentication, enabling data exfiltration, manipulation, or deletion. The publicly disclosed exploit leverages this weakness by injecting SQL commands that bypass security checks, executing arbitrary database operations.
DailyCVE Form
Platform: WCMS
Version: 11
Vulnerability: SQL Injection
Severity: Critical
Date: 2025-04-19
Prediction: Patch by 2025-08-30
What Undercode Say
Analytics:
SELECT FROM users WHERE phone = '[bash]';
curl -X POST -d "mobile_phone=1' OR 1=1--" http://target.com/api
How Exploit
- Craft SQL payload in `mobile_phone` parameter.
- Bypass authentication via UNION-based injection.
- Exfiltrate database contents.
Protection from this CVE
- Apply input validation.
- Use prepared statements.
- Update to patched version.
Impact
- Data leakage.
- Unauthorized access.
- Database compromise.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
