An authenticated, low-privileged user can achieve remote code execution on WuzhiCMS 5.0.0 by uploading malicious PHP files via the thumbnail-upload feature.

The application fails to validate the file extension or content type in the thumbnail-upload endpoint. An authenticated user with low privileges can upload a crafted PHP file, which is then stored in a web-accessible directory and executed by the server.

Successful exploitation results in full system compromise, as the attacker can execute arbitrary code with the permissions of the web server. Given the CVSS score of 8.8, this represents a high-severity threat that could lead to complete data theft, site defacement, or lateral movement within the hosting environment.

Immediate Action: Apply security updates from the vendor as soon as they are made available to address the file validation flaw.

Proactive Monitoring: Audit the uploadfile/ directory for any suspicious non-image files and monitor server logs for unauthorized access to uploaded PHP scripts.

Compensating Controls: Configure the web server to prevent the execution of scripts within the uploads directory and implement a WAF to inspect and block file uploads containing malicious extensions.

Public Exploit Available: Yes, a published proof-of-concept exists as referenced in the vulnerability report (GitHub Issue 6).

The existence of a public proof-of-concept elevates the risk of this vulnerability significantly. Organizations currently using WuzhiCMS 5.0.0 should restrict access to the thumbnail-upload functionality and prioritize the installation of the vendor patch as soon as it is released. Regular integrity checks on the uploads directory are strongly recommended until a permanent fix is applied.