Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

CVE-2023-39796 — AI Deep Analysis Summary

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Unauthenticated SQL Injection in WBCE CMS v1.6.0 via `DB_RECORD_TABLE`.…

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: Lack of input validation in the `miniform` module.…

Q3Who is affected? (Versions/Components)

📦 **Affected**: WBCE CMS version **1.6.0**. The vulnerability resides in the default **miniform module** which is installed by default.

Q4What can hackers do? (Privileges/Data)

🕵️ **Attacker Capabilities**: As an **unauthenticated** user, hackers can bypass login requirements. They can manipulate the database via SQL injection, leading to data theft, modification, or full system takeover.

Q5Is exploitation threshold high? (Auth/Config)

⚡ **Exploitation Threshold**: **LOW**. No authentication is required. The vulnerability is accessible remotely to anyone who can reach the CMS endpoint.

Q6Is there a public Exp? (PoC/Wild Exploitation)

🔓 **Public Exp?**: **YES**. Proof of Concept (PoC) is available via Nuclei templates on GitHub (projectdiscovery/nuclei-templates). The vulnerability is well-documented.

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: Scan for the presence of the `miniform` module. Check if `/modules/miniform/ajax_delete_message.php` exists and is accessible. Use SQL injection scanners targeting the `DB_RECORD_TABLE` parameter.

Q8Is it fixed officially? (Patch/Mitigation)

✅ **Official Fix**: **YES**. The vendor released version **1.6.1** to patch this vulnerability. Check the official GitHub releases for the update.

Q9What if no patch? (Workaround)

🛑 **No Patch Workaround**: If you cannot upgrade immediately, **disable or uninstall the `miniform` module**. Ensure the `ajax_delete_message.php` file is not accessible or remove it from the server.

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **HIGH**. Since it is unauthenticated and allows database takeover, immediate patching to v1.6.1 or disabling the module is critical to prevent compromise.