This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis →
Q1What is this vulnerability? (Essence + Consequences)
🚨 **Essence**: Unauthenticated SQL Injection in WBCE CMS v1.6.0 via `DB_RECORD_TABLE`.…
📦 **Affected**: WBCE CMS version **1.6.0**. The vulnerability resides in the default **miniform module** which is installed by default.
Q4What can hackers do? (Privileges/Data)
🕵️ **Attacker Capabilities**: As an **unauthenticated** user, hackers can bypass login requirements. They can manipulate the database via SQL injection, leading to data theft, modification, or full system takeover.
Q5Is exploitation threshold high? (Auth/Config)
⚡ **Exploitation Threshold**: **LOW**. No authentication is required. The vulnerability is accessible remotely to anyone who can reach the CMS endpoint.
Q6Is there a public Exp? (PoC/Wild Exploitation)
🔓 **Public Exp?**: **YES**. Proof of Concept (PoC) is available via Nuclei templates on GitHub (projectdiscovery/nuclei-templates). The vulnerability is well-documented.
Q7How to self-check? (Features/Scanning)
🔍 **Self-Check**: Scan for the presence of the `miniform` module. Check if `/modules/miniform/ajax_delete_message.php` exists and is accessible. Use SQL injection scanners targeting the `DB_RECORD_TABLE` parameter.
Q8Is it fixed officially? (Patch/Mitigation)
✅ **Official Fix**: **YES**. The vendor released version **1.6.1** to patch this vulnerability. Check the official GitHub releases for the update.
Q9What if no patch? (Workaround)
🛑 **No Patch Workaround**: If you cannot upgrade immediately, **disable or uninstall the `miniform` module**. Ensure the `ajax_delete_message.php` file is not accessible or remove it from the server.
Q10Is it urgent? (Priority Suggestion)
🔥 **Urgency**: **HIGH**. Since it is unauthenticated and allows database takeover, immediate patching to v1.6.1 or disabling the module is critical to prevent compromise.