CVE-2018-1000087

Vulnerability

WolfCMS version 0.8.3.1 contains a reflected Cross-Site Scripting vulnerability in the 'Create New File' and 'Create New Directory' input boxes within the 'files' Tab. The application fails to sanitize user input in these fields, allowing injection of arbitrary JavaScript. This flaw exists in the stable release as confirmed by the reporter [1].

Exploitation

An attacker can craft a malicious URL containing JavaScript payload (e.g., ``) in the vulnerable input parameter. The victim must be tricked into clicking the crafted link, which then executes the script in the context of the WolfCMS session. No authentication is required for the attacker to deliver the payload [1].

Impact

Successful exploitation enables the attacker to hijack user sessions, spread worms, and remotely control the victim's browser. This can lead to information disclosure, unauthorized actions, and potential compromise of the CMS instance [1].

Mitigation

As of the publication date (2018-03-13), no official patch or fixed version has been released. Users are advised to apply input sanitization or validation as a workaround, such as filtering script tags in the affected fields. No CVE listing in KEV has been noted [1].