Description

RCE in CP > ADMIN > site structure (it needs admin privilege)

Because of the typo in the sanitization. Anyone who has admin privilege can edit “site structure”, bypass it and execute php code. And we can execute system() or other system function by php, so that's a RCE vulnerability.

And next few line, there is a correct one. But it still can be bypass through escape backslash.

Proof of Concept

To first typo sanitization, it's ‘; phpinfo(); //.

To second sanitization, it's \‘; phpinfo(); //.

And that's the demo video

Impact

Anyone who has admin privilege can edit “site structure”, bypass it and execute php code. And we can execute system() or other system function by php, so that's said admin can control the full computer if phpwcms not setted properly.