taosir WTCMS Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in taosir WTCMS versions prior to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. The issue arises in the 'fetch' function of 'index.php', where improper handling of the 'content' parameter allows for code injection. This vulnerability can be exploited remotely, without authentication.

Impact

Exploitation of this vulnerability allows for arbitrary PHP code execution on the server.

Reproduction

To reproduce this vulnerability, send a GET request to 'index.php' with the 'a' parameter set to 'fetch' and the 'content' parameter containing malicious PHP code. The injected code will be executed on the server.