Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component.
The attached exploit "exploit.py" performs the following actions:
- It takes 3 arguments:
- URL: where WonderCMS is installed (no need to know the password)
- IP: attacker's Machine IP
- Port No: attacker's Machine PORT
- It generates an xss.js file (for reflected XSS) and outputs a malicious link.
- As soon as the admin (logged user) opens/clicks the malicious link, a few background requests are made without admin acknowledgement to upload a shell via the upload theme/plugin functionality.
- After uploading the shell, it executes the shell and the attacker gets the reverse connection of the server.
