Listen to this Post
How CVE-2025-3798 Works
The vulnerability exists in WCMS 11’s Advertisement Image Handler component within app/admin/AdvadminController.php. The `sub` function fails to properly validate file uploads, allowing attackers to remotely upload malicious files without restrictions. This can lead to arbitrary code execution or server compromise. The attack vector is network-based, requiring high privileges but no user interaction. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L) indicates network accessibility with low attack complexity.
DailyCVE Form
Platform: WCMS
Version: 11
Vulnerability: Unrestricted Upload
Severity: Critical
Date: 07/15/2025
Prediction: Patch by 08/30/2025
What Undercode Say
$ curl -X POST -F "[email protected]" http://target/admin/AdvadminController.php/sub grep -r "move_uploaded_file" app/admin/ chmod -R 750 app/admin/AdvadminController.php
How Exploit
Remote attackers upload malicious files via unsecured endpoint.
Protection from this CVE
Implement file type verification.
Restrict upload permissions.
Apply input sanitization.
Impact
Arbitrary code execution possible.
Server compromise likely.
Privilege escalation potential.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
