High · published December 11, 2025
🚨 A low-privileged user can execute arbitrary SQL queries with just a tweak to their profile settings! 🔥 Think of it like a restaurant employee who can change the menu but ends up swapping out all the ingredients for something toxic — the damage could be catastrophic! If exploited, this vulnerability allows attackers to gain full control over the database, compromising sensitive information and potentially exfiltrating user data. It’s like leaving the vault wide open for anyone with a key, leading to an absolute data heist!
Think of it like a restaurant employee who can change the menu but ends up swapping out all the ingredients for something toxic — the damage could be catastrophic! This SQL injection vulnerability in WBCE CMS allows a low-privileged authenticated user to manipulate the `groups[]` parameter in the user edit form, leading to execution of arbitrary SQL queries in the admin/users/save.php script.
If exploited, this vulnerability allows attackers to gain full control over the database, compromising sensitive information and potentially exfiltrating user data. It’s like leaving the vault wide open for anyone with a key, leading to an absolute data heist! To protect your site, immediately upgrade WBCE CMS to version 1.6.5 to close this loophole. Review user permissions to ensure that only trusted users can modify accounts, and consider implementing additional input validation for safety. 🛡️ You've got this! Follow these steps, and you’ll have your site secured in no time! ✨
| Product | Versions | Fixed in |
|---|---|---|
| wbce/wbce_cms | < 1.6.5 | 1.6.5 |