CVE-2020-19902
📋 TL;DR
CVE-2020-19902 is a critical directory traversal vulnerability in Cryptoprof WCMS v0.3.2 that allows remote attackers to execute arbitrary code via the wex/cssjs.php parameter. This affects all systems running the vulnerable version of WCMS, potentially enabling complete system compromise.
💻 Affected Systems
- Cryptoprof WCMS
📦 What is this software?
Wcms by Wcms
⚠️ Risk & Real-World Impact
Worst Case
Remote attacker gains full system control, installs malware, steals data, and pivots to other systems.
Likely Case
Attacker uploads web shell, defaces website, steals sensitive data, and establishes persistent access.
If Mitigated
Attack prevented by proper input validation and file permission restrictions.
🎯 Exploit Status
Simple directory traversal via wex/cssjs.php parameter allows arbitrary file upload/execution.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://github.com/vedees/wcms/issues/3
Restart Required: No
Instructions:
No official patch exists. Upgrade to a different CMS or apply workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to block directory traversal sequences in wex/cssjs.php
Add path traversal filtering in wex/cssjs.php: preg_replace('/\.\.\//', '', $input)
File Permission Restriction
linuxRestrict PHP execution in upload directories
Add to .htaccess: php_flag engine off
chmod 644 upload_directory/*
🧯 If You Can't Patch
- Block access to wex/cssjs.php via web application firewall
- Isolate WCMS instance in separate network segment with strict egress filtering
🔍 How to Verify
Check if Vulnerable:
Check if WCMS version is 0.3.2 and wex/cssjs.php exists and accepts file path parameters.Check Version:
Check WCMS configuration files or admin panel for version information.Verify Fix Applied:
Test if directory traversal attempts via wex/cssjs.php are blocked and return error.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to wex/cssjs.php with ../ sequences
- Unusual file uploads or PHP execution in unexpected directories
Network Indicators:
- POST/GET requests to wex/cssjs.php with path traversal payloads
SIEM Query:
web.url:*wex/cssjs.php* AND (web.uri:*../* OR web.query:*../*)