CVE-2025-59110

A Blind SQL injection vulnerability has been found in Windu CMS. An unauthenticated remote attacker can inject SQL syntax into the URL path in HTTP headers. Confirmed in version 4.1, but other versions may also be affected.

Windu CMS does not validate uploaded file types, allowing an authenticated attacker to upload arbitrary files, including PHP. This can lead to Remote Code Execution (RCE). Confirmed in version 4.1, but other versions may be affected.

Windu CMS uses hashing algorithms based on MD5 and SHA1 with static salt to store user passwords. This allows an attacker who obtains a password hash to decode user credentials. The vulnerability has been confirmed in version 4.1 but may affect other versions.

Windu CMS is vulnerable to multiple Stored Cross-Site Scripting (XSS) vulnerabilities in the page editing endpoint windu/admin/content/pages/edit/. This vulnerability can be exploited by a privileged user and may target users with higher privileges. Only version 4.1 was tested and confirmed as vulnerable; this issue was fixed in version 4.1 build 2250.

Windu CMS is vulnerable to User Enumeration. This issue occurs during logon, where a difference in messages could allow an attacker to determine if the login is valid or not, enabling a brute force attack with valid logins. Only version 4.1 was tested and confirmed as vulnerable. This issue was fixed in version 4.1 build 2250.

Windu CMS is vulnerable to Stored Cross-Site Scripting (XSS) in the logon page where input data is not properly validated. A malicious attacker can inject arbitrary HTML and JS into the website, which will be rendered/executed when an administrator visits the logs page. Only version 4.1 was tested and confirmed vulnerable; the issue was fixed in version 4.1 build 2250.

Windu CMS is vulnerable to Cross-Site Request Forgery in the file uploading functionality. A malicious attacker can craft a special website that, when visited by the victim, automatically sends a malicious file to the server.

Windu CMS implements weak client-side brute-force protection using the loginError parameter; attempt count and timeout are not stored server-side, allowing attackers to bypass protection by resetting the parameter. Version 4.1 was confirmed vulnerable; fixed in 4.1 build 2250.

Windu CMS is vulnerable to Cross-Site Request Forgery in the user editing functionality. A malicious attacker can craft a special website that, when visited by the victim, automatically sends a POST request that deletes a given user.

Windu CMS version 4.1 is vulnerable to Broken Access Control in the user editing functionality. A malicious attacker can send a GET request that allows privileged users to delete Super Admins, which is not possible through the GUI. The issue was fixed in version 4.1 build 2250.