Wolf CMS before 0.8.3.1 allows unrestricted file rename and PHP Code Execution because admin/plugin/file_manager/browse/ (aka the filemanager) does not prevent a change of a file extension to ".php" after originally using the parameter "filename" for uploading a JPEG image. Exploitation requires a registered user who has access to upload functionality.
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
| Link | Tags |
|---|---|
| http://www.websecgeeks.com/2015/08/wolf-cms-arbitrary-file-upload-to.html | exploit third party advisory technical description |
| https://github.com/wolfcms/wolfcms/issues/625 | third party advisory |
| https://github.com/wolfcms/wolfcms/releases/tag/0.8.3.1 | third party advisory release notes |
| https://www.exploit-db.com/exploits/38000/ | exploit |
| https://www.exploit-db.com/exploits/40004/ | exploit |
| https://github.com/wolfcms/wolfcms/commit/2160275b60736f706dfda132c7c46728c5b255fa | third party advisory patch |
| https://www.wolfcms.org/blog/2015/08/10/releasing-wolf-cms-0-8-3-1.html | third party advisory release notes |