CyberRota Analysis
AI-GeneratedWuzhiCMS 5.0.0 is vulnerable to an unrestricted file upload in the thumbnail-upload endpoint, allowing authenticated low-privileged users to upload malicious PHP files. This flaw enables the execution of arbitrary PHP code on the server, posing a significant risk of remote code execution. Organizations using this CMS should prioritize patching this vulnerability to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint (/index.php?m=member&f=article&v=thumbUpload) of WuzhiCMS 5.0.0 allows an authenticated low-privileged member to upload a crafted .php file and execute arbitrary PHP code on the server, because the stored file extension is taken verbatim from the client-supplied filename with no extension allowlist or content validation and the file is written to the web-accessible uploadfile/ directory, from which the web server executes PHP.