CVE-2023-31689

CVE-2023-31689 is a critical arbitrary file upload vulnerability affecting Wcms version 0.3.2. An unauthenticated attacker can exploit this flaw by sending a crafted request to the /wcms/wex/html.php endpoint, manipulating the 'finish' and 'textAreaCode' parameters to write arbitrary strings to custom file names and upload malicious files. This allows for remote code execution, leading to a complete compromise of confidentiality, integrity, and availability, as reflected by its CVSS score of 9.8 (CRITICAL). While there is no evidence of active exploitation or publicly available exploit code in Metasploit or ExploitDB, the vulnerability has garnered significant community discussion, indicating potential interest from threat actors.