Wolf CMS 0.8.3.1 Code Execution Exploit Published — Detection and Remediation for Legacy CMS Exposure

---
title: Web Server Process Spawning Shell - Possible Wolf CMS Web Shell Execution
id: 3f8c2a71-9b4e-4d1a-a6c2-5e7f8a9b0c1d
status: experimental
description: Detects a web server or PHP process spawning operating system command interpreters, consistent with post-exploitation activity following CMS code execution such as the Wolf CMS 0.8.3.1 exploit (Exploit-DB 52672).
references:
  - https://www.exploit-db.com/exploits/52672
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/12
tags:
  - attack.execution
  - attack.t1059
  - attack.t1505.003
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/apache2'
      - '/httpd'
      - '/nginx'
      - '/php-fpm'
      - '/php-cgi'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/perl'
      - '/python'
      - '/python3'
      - '/nc'
      - '/ncat'
      - '/curl'
      - '/wget'
      - '/id'
  condition: selection_parent and selection_child
falsepositives:
  - Rarely, legitimate PHP applications shelling out for image processing or mail delivery; baseline per application
level: high
---
title: IIS Worker Process Spawning Command Interpreter - Possible CMS Web Shell
id: 6b1d4e82-2c7f-4a93-b5d8-8e2f1a3c4d5e
status: experimental
description: Detects the IIS worker process (w3wp.exe) or PHP CGI spawning Windows command interpreters, consistent with web shell execution after CMS code execution such as the Wolf CMS 0.8.3.1 exploit.
references:
  - https://www.exploit-db.com/exploits/52672
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/01/12
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\php-cgi.exe'
      - '\php.exe'
      - '\httpd.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\certutil.exe'
      - '\curl.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legacy applications that legitimately invoke command-line tools from PHP; rare on CMS workloads
level: high
---
title: Executable PHP File Created in CMS Content or Upload Directory
id: 9a4e7c15-3d8b-4f26-c1e9-7a3b5d6e8f2a
status: experimental
description: Detects creation of PHP files in web content, upload, or public directories of PHP CMS installations, a hallmark of web shell deployment following authenticated CMS code execution (e.g., Wolf CMS 0.8.3.1, Exploit-DB 52672).
references:
  - https://www.exploit-db.com/exploits/52672
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/01/12
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
      - '/uploads/'
      - '/public/'
      - '/files/'
      - '/content/'
      - '/tmp/'
      - '/var/www/'
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.php3'
      - '.php4'
      - '.php5'
      - '.php7'
      - '.phar'
  condition: selection
falsepositives:
  - Legitimate deployments and developer activity writing PHP into the application root; tune by excluding known deployment paths and service accounts
level: high

let WebParents = dynamic(['w3wp.exe','php-cgi.exe','php.exe','httpd.exe','apache2','httpd','nginx','php-fpm','php-cgi']);
let ShellChildren = dynamic(['cmd.exe','powershell.exe','pwsh.exe','whoami.exe','net.exe','certutil.exe','sh','bash','dash','perl','python','python3','nc','ncat','curl','wget']);
let ProcEvents = union isfuzzy=true
    (DeviceProcessEvents
    | where InitiatingProcessFileName in~ (WebParents)
    | where FileName in~ (ShellChildren)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName, SourceTable="DeviceProcessEvents"),
    (Syslog
    | where SyslogMessage has_any ("php-fpm","apache2","httpd","nginx")
      and SyslogMessage has_any ("/bin/sh","/bin/bash","/usr/bin/curl","/usr/bin/wget","/usr/bin/python")
    | project TimeGenerated, Computer, ProcessName, SyslogMessage, SourceTable="Syslog");
let WebRequests = CommonSecurityLog
    | where DeviceVendor =~ "Apache" or ApplicationProtocol =~ "http" or DeviceProduct has_any ("IIS","nginx","Apache")
    | where RequestURL has_any ("/uploads/","/files/","/public/","/content/")
      and RequestURL endswith ".php"
      and (RequestMethod =~ "POST" or RequestURL has_any ("cmd=","exec=","shell=","c=","passthru=","system="))
    | project TimeGenerated, SourceIP, DestinationHostName, RequestURL, RequestMethod, SourceTable="CommonSecurityLog";
union isfuzzy=true ProcEvents, WebRequests
| order by TimeGenerated desc

-- Hunt for recently written PHP files in CMS content/upload paths (potential web shells)
-- and enumerate web server processes for parent-child anomalies
LET cutoff = now() - (7 * 24 * 3600)
LET webshell_paths = [
  '/var/www/**/uploads/**.php',
  '/var/www/**/public/**.php',
  '/var/www/**/files/**.php',
  '/var/www/**/content/**.php',
  '/srv/www/**/uploads/**.php',
  'C:/inetpub/wwwroot/**/uploads/**.php',
  'C:/inetpub/wwwroot/**/files/**.php'
]
LET candidates = SELECT FullPath, Mtime, Size,
       read_file(filename=FullPath, length=2048) AS Head
FROM foreach(row=webshell_paths, query={
  SELECT FullPath, Mtime, Size FROM glob(globs=FullPath)
})
WHERE Mtime > cutoff
  AND Head =~ 'eval|base64_decode|shell_exec|passthru|system\(|assert\(|preg_replace.*/e|$_GET|$_POST|$_REQUEST'
SELECT FullPath, Mtime, Size, Head FROM candidates

#!/usr/bin/env bash
# Security Arsenal - Wolf CMS exposure inventory and PHP execution hardening
# Run as root or with sudo on web servers. Review findings before applying hardening.

set -u
DOCROOTS="/var/www /srv/www /home/*/public_html"
REPORT="wolfcms_audit_$(date +%Y%m%d_%H%M%S).txt"

echo "=== Wolf CMS Exposure Audit $(date) ===" | tee "$REPORT"

# 1) Locate Wolf CMS installations by fingerprinting config.php for the Wolf CMS schema marker
echo "[+] Searching for Wolf CMS installations..." | tee -a "$REPORT"
find $DOCROOTS -maxdepth 6 -name 'config.php' 2>/dev/null | while read -r cfg; do
  if grep -qiE 'wolfcms|wolf[_-]?cms|Wolf CMS' "$cfg" 2>/dev/null; then
    echo "  [WOLF CMS DETECTED] $cfg" | tee -a "$REPORT"
    grep -iE 'DB_(NAME|USER|HOST)' "$cfg" | sed 's/^/      /' | tee -a "$REPORT"
  fi
done

# 2) Find PHP files sitting in upload/content directories (web shell candidates)
echo "[+] Scanning upload/content directories for executable PHP..." | tee -a "$REPORT"
find $DOCROOTS -maxdepth 8 -type d \( -iname 'uploads' -o -iname 'files' -o -iname 'public' -o -iname 'content' \) 2>/dev/null | while read -r dir; do
  hits=$(find "$dir" -maxdepth 3 -type f \( -name '*.php' -o -name '*.phtml' -o -name '*.phar' \) 2>/dev/null)
  if [ -n "$hits" ]; then
    echo "  [SUSPICIOUS PHP] under $dir" | tee -a "$REPORT"
    echo "$hits" | sed 's/^/      /' | tee -a "$REPORT"
  fi
done

# 3) Flag recently modified PHP files anywhere in docroots (last 14 days)
echo "[+] PHP files modified in the last 14 days (review for web shells)..." | tee -a "$REPORT"
find $DOCROOTS -type f -name '*.php' -mtime -14 2>/dev/null | sed 's/^/      /' | tee -a "$REPORT"

# 4) Compensating control: drop a hardening .htaccess into upload/content dirs to block PHP execution
echo "[+] Applying PHP execution block (Apache) to upload/content directories..." | tee -a "$REPORT"
find $DOCROOTS -maxdepth 8 -type d \( -iname 'uploads' -o -iname 'files' -o -iname 'public' -o -iname 'content' \) 2>/dev/null | while read -r dir; do
  ht="$dir/.htaccess"
  if [ ! -f "$ht" ]; then
    cat > "$ht" <<'EOF'
# Security Arsenal hardening: deny PHP execution in this directory
php_flag engine off
RemoveHandler .php .phtml .phar
<FilesMatch "\.(php|phtml|phar|php3|php4|php5|php7)$">
  Require all denied
</FilesMatch>
EOF
    echo "  [HARDENED] $ht" | tee -a "$REPORT"
  fi
done

echo "=== Audit complete. Review $REPORT and escalate any findings to IR. ===" | tee -a "$REPORT"