CVE-2010-20125
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating the uninitialized code parameter passed to require_once. Attackers can supply path traversal sequences ../../ to include arbitrary local files outside the intended payment directory, potentially achieving local file disclosure. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
Risk Assessment
An unauthenticated attacker can disclose local server files, potentially leaking configuration data, credentials, or source code.
Recommendation
Upgrade DedeCMS to version 5.7 or later. If upgrading is not possible, restrict access to plus/carbuyaction.php and monitor for path traversal attempts in request parameters.
Other vulnerabilities in DedeCMS
See all- CVE-2017-17727High
DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templet parameter to member/article_edit.php.
- CVE-2021-48016Critical
DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to /plus/flink.php?dopost=save with an empty validation code to execute arbitrary PHP and system commands.
- CVE-2026-38615Critical
A command execution vulnerability in DedeCMS V5.7.118 in file_manage_control.php allows an attacker to execute arbitrary commands on the server.
- CVE-2023-34842Critical
Remote Code Execution vulnerability in DedeCMS through version 5.7.109 allows an attacker to execute arbitrary code via a crafted POST request to /dede/tpl.php.
- CVE-2023-37839Critical
DedeCMS v5.7.109 has an arbitrary file upload vulnerability in /dede/file_manage_control.php that allows attackers to execute arbitrary code by uploading a crafted PHP file.
- CVE-2017-17731Critical
DedeCMS through 5.7 is vulnerable to SQL Injection via the $_FILES superglobal in plus/recommend.php.
- CVE-2017-17730Critical
DedeCMS versions up to 5.7 are vulnerable to SQL Injection via the logo parameter in plus/flink_add.php.
- CVE-2026-116253High
A vulnerability was found in DedeCMS 5.7.118 affecting the common.inc.php::_RunMagicQuotes function in plus/ad_js.php of the Advertisement Rendering component. Manipulating the aid argument can lead to code injection, and the attack can be executed remotely.
- CVE-2026-116063Medium
A weakness was identified in DedeCMS up to 5.7.118 in the require_once function of dede/update_guide.php. Manipulating the vtime argument causes code injection. Remote exploitation is possible and the exploit has been made public.
- CVE-2014-125131Medium
DedeCMS 5.6 and 5.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input to the adminDirHand parameter. Attackers can send crafted GET requests to /include/dialog/config.php that close the generated script tag and inject JavaScript, which executes in the victim's browser.
Original NVD description (English source)
DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating the uninitialized code parameter passed to require_once. Attackers can supply path traversal sequences ../../ to include arbitrary local files outside the intended payment directory, potentially achieving local file disclosure. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS