CVE-2023-31689 (wcms)

In Wcms 0.3.2, an attacker can send a crafted request from a vulnerable web application backend server /wcms/wex/html.php via the finish parameter and the textAreaCode parameter. It can write arbitrary strings into custom file names and upload any files, and write malicious code to execute scripts to trigger command execution.

application backend code command cve file files html malicious names parameter php request scripts send server strings trigger upload vulnerable vulnerable web application web web application