Overview
A critical privilege escalation vulnerability, identified as CVE-2025-65094, has been discovered in WBCE CMS. This flaw allows a low-privileged user to escalate their privileges to the Administrators group, potentially leading to a complete compromise of the affected CMS installation. The vulnerability resides in the /admin/users/save.php script and stems from a lack of server-side validation of user group assignments.
Technical Details
The vulnerability occurs because WBCE CMS versions prior to 1.6.4 do not properly validate the groups[] parameter in the /admin/users/save.php request. While the user interface restricts users to assigning only their existing group, the server-side logic fails to enforce this restriction. An attacker can manipulate the groups[] parameter to include the Administrators group ID, effectively granting themselves full administrative access. This bypasses the intended access control mechanisms and allows unauthorized modification of system settings, content, and user accounts.
The specific code change that addresses this vulnerability can be found in the following commit:
CVSS Analysis
Due to incomplete information, the CVSS score has not yet been calculated. However, given the nature of the vulnerability (unauthenticated privilege escalation to administrator), it would likely receive a Critical severity rating, with a CVSS score close to 10.0. Factors contributing to this severity are:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low (Existing user account)
- User Interaction: None
- Scope: Changed
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
We will update this section as soon as the official CVSS score is available.
Possible Impact
The impact of this vulnerability is severe. A successful exploit allows a low-privileged user to gain full administrative control over the WBCE CMS installation. This can lead to:
- Complete website defacement or takeover.
- Data theft, including sensitive user information.
- Malware injection and distribution.
- Denial-of-service attacks.
- Creation of rogue administrator accounts for persistent access.
Because of the relative ease of exploit and the catastrophic potential outcome, affected sites should be upgraded immediately.
Mitigation & Patch Steps
The recommended mitigation is to upgrade to WBCE CMS version 1.6.4 or later. This version includes the necessary fix to validate user group assignments on the server-side, preventing the privilege escalation.
- Backup your website: Before upgrading, create a full backup of your website files and database.
- Upgrade WBCE CMS: Upgrade to version 1.6.4 through the WBCE CMS admin panel or by manually replacing the files.
- Verify the fix: After upgrading, confirm that the vulnerability is resolved by attempting to manipulate the
groups[]parameter. The attempt should fail, preventing privilege escalation.
References
WBCE CMS Commit – 96046178f4c80cf16f7c224054dec7fdadddda7e
WBCE CMS Security Advisory – GHSA-hmmw-4ccm-fx44
CVE-2025-65094 at MITRE
