Attack Chain

1. Attacker authenticates to the Wolf CMS administrative interface using valid, potentially compromised, credentials.
2. Attacker verifies they possess the file_manager_mkfile capability within the application.
3. Attacker navigates to the File Manager module within the administrative dashboard.
4. Attacker invokes the create_file() or save() function to create a new file, providing a malicious payload formatted as PHP code.
5. Attacker bypasses the missing server-side extension validation, ensuring the file is saved with a .php extension in the FILES_DIR directory.
6. Application writes the attacker-supplied PHP content to the server disk at the specified path.
7. Attacker triggers the execution of the malicious script by navigating to the file path via a standard browser HTTP request.
8. Web server executes the PHP payload, resulting in remote code execution under the context of the web server user.

Impact

Successful exploitation of this vulnerability allows an authenticated attacker to achieve remote code execution on the underlying web server. This can lead to full compromise of the web application, potential lateral movement within the hosting environment, and exfiltration of sensitive configuration or database information. Given the nature of the application, this flaw is particularly dangerous for small-to-medium organizations relying on Wolf CMS for content management.

Recommendation

1. Immediately audit user roles and capabilities in Wolf CMS to identify accounts with the file_manager_mkfile privilege; restrict this access to trusted administrators only.
2. Monitor web server logs for suspicious requests to files created within the FILES_DIR path, particularly those ending in .php.
3. Deploy the provided Sigma rule to detect POST requests to the FileManagerController that coincide with file creation events.
4. Review the Wolf CMS GitHub repository for updates and patch to a version beyond 0.8.3.1 immediately once available.