CyberRota Analysis
AI-GeneratedWebsiteBaker CMS versions prior to 2.13.10 are vulnerable to an unrestricted file upload flaw in the module installation feature, allowing authenticated administrators to upload a malicious ZIP file containing a PHP webshell. This vulnerability enables remote code execution, as the webshell can be extracted to a publicly accessible directory, making it executable by unauthenticated users. Organizations using this CMS should prioritize patching to mitigate the risk of unauthorized access and potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerability in the module installation feature that allows authenticated administrators to achieve remote code execution by uploading a crafted ZIP archive containing a PHP webshell alongside a valid info.php metadata file. Attackers can place the malicious archive through the module installation interface, causing the application to extract the webshell into a web-accessible modules/ subdirectory where it becomes immediately executable by any unauthenticated user via direct HTTP request.