CyberRota Analysis
AI-GeneratedCertain Woltlab products, specifically WCF versions 6.1.0 to 6.1.22 and 6.2.0 to 6.2.5, are vulnerable to remote code execution through cache poisoning, allowing authenticated low-privileged users to inject PHP code into executable cache files. This vulnerability can lead to unauthorized execution of arbitrary PHP code, potentially compromising the integrity of the application. Organizations using these versions should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Certain Woltlab products are affected by RCE via Cache Poisoning. WCF >= 6.1.0 until < 6.1.23 and WCF >= 6.2.0 until < 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. Attacker-controlled data can terminate the nowdoc prematurely and inject arbitrary PHP Code.