WebsiteBaker Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in WebsiteBaker version 2.13.0. This issue allows authenticated users with language editing permissions to execute arbitrary code on the server. The vulnerability arises from a misconfiguration in the language installation endpoint, where attackers can manipulate installation parameters to achieve code execution.

Impact

Exploitation of this vulnerability allows for authenticated remote code execution on the server.

Reproduction

To reproduce this vulnerability, log into the WebsiteBaker admin panel with a user account that has language editing permissions. Navigate to the languages installation page. Once there, upload a PHP file containing malicious code through the language installation form. After the file is uploaded, it can be executed by accessing it via the web server, appending the appropriate command parameters to the request.