Executive brief
WTCMS is a content management system used to build and manage websites. An unauthenticated attacker can inject arbitrary PHP code through a parameter in the fetch function, allowing them to execute arbitrary commands on the server and take complete control of the website, including accessing or modifying all hosted data.
Technical details
The vulnerability is a code injection flaw in the fetch function of WTCMS's index.php endpoint. An attacker can manipulate the "content" parameter in a GET request to inject arbitrary PHP code without authentication. The injected code is executed server-side, allowing an attacker to write files, execute system commands, and achieve remote code execution. The attack requires only network access to the vulnerable endpoint and no authentication is necessary. A public proof-of-concept exploit exists that writes a PHP file to the server and executes arbitrary system commands. The vendor was contacted but did not respond, and no patch has been released.
Affected products
- taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665
Timeline
- 2025-11-30: disclosed
- other: Public exploit available