| Field | Details |
|---|---|
| CVE ID | CVE-2025-65950 |
| Severity | CRITICAL |
| Advisory | View Advisory |
| Discovered by | Lukasz Rybak |
- WBCE/WBCE_CMS
A critical SQL Injection vulnerability in the user management module allows a low-privileged authenticated user with permissions to modify users to execute arbitrary SQL queries. This can be escalated to a full database compromise, data exfiltration, effectively bypassing all security controls.
The vulnerability exists in the admin/users/save.php script, which handles updates to user profiles. The script improperly processes the groups[] parameter sent from the user edit form.
The proof of concept involves using a time-based blind SQL injection to confirm arbitrary SQL execution.
- Prerequisites:
- An authenticated user account belonging to a group with "Users - Modify" (
users_modify) permissions. This user does not need to be a full administrator.
- An authenticated user account belonging to a group with "Users - Modify" (
-
Reproduction Steps:
a. Log in as the low-privileged user. b. Navigate to "Access" -> "Users" and select any user for modification.
c. Capture the POST request sent to /wbce/admin/users/save.php when the "Save" button is clicked.
d. Edit `groups[]` parameter with the following URL-encoded payload, which will attempt to make the database wait for 10 seconds: groups%5B%5D=2%27+%2C+%60active%60+%3D+SLEEP(10)+--+
*(Decoded payload: 2' , `active` = SLEEP(10) -- )*
f. Send the modified request.
- Verification:
Data Exfiltration Example: Retrieving the Database Name
**Example Payload to Test a Character:**
groups%5B%5D=2%27+%2C+%60active%60+%3D+IF(SUBSTRING(DATABASE()%2C+1%2C+1)+%3D+%27w%27%2C+SLEEP(5)%2C+0)+--+
This manual process can be continued to reveal the full database name and, subsequently, any other data in the database.
A low-privileged user, who should only be able to make benign changes to user profiles, can gain full control over the database.
The impact includes, but is not limited to:
- Reading all data from any table, including session data, password hashes, and personal user information.
- https://github.com/WBCE/WBCE_CMS/security/advisories/GHSA-934v-xhx9-j2f3
- https://github.com/WBCE/WBCE_CMS/commit/96046178f4c80cf16f7c224054dec7fdadddda7e
- https://github.com/WBCE/WBCE_CMS/releases/tag/1.6.5
This CVE was responsibly disclosed following coordinated vulnerability disclosure practices. The information provided here is for educational and defensive purposes only.