DedeCMS vulnerabilities

DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templet parameter to member/article_edit.php.

DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to /plus/flink.php?dopost=save with an empty validation code to execute arbitrary PHP and system commands.

A command execution vulnerability in DedeCMS V5.7.118 in file_manage_control.php allows an attacker to execute arbitrary commands on the server.

Remote Code Execution vulnerability in DedeCMS through version 5.7.109 allows an attacker to execute arbitrary code via a crafted POST request to /dede/tpl.php.

DedeCMS v5.7.109 has an arbitrary file upload vulnerability in /dede/file_manage_control.php that allows attackers to execute arbitrary code by uploading a crafted PHP file.

DedeCMS through 5.7 is vulnerable to SQL Injection via the $_FILES superglobal in plus/recommend.php.

DedeCMS versions up to 5.7 are vulnerable to SQL Injection via the logo parameter in plus/flink_add.php.

DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating the uninitialized code parameter passed to require_once. Attackers can supply path traversal sequences ../../ to include arbitrary local files outside the intended payment directory, potentially achieving local file disclosure. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.

A vulnerability was found in DedeCMS 5.7.118 affecting the common.inc.php::_RunMagicQuotes function in plus/ad_js.php of the Advertisement Rendering component. Manipulating the aid argument can lead to code injection, and the attack can be executed remotely.

A weakness was identified in DedeCMS up to 5.7.118 in the require_once function of dede/update_guide.php. Manipulating the vtime argument causes code injection. Remote exploitation is possible and the exploit has been made public.

DedeCMS 5.6 and 5.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input to the adminDirHand parameter. Attackers can send crafted GET requests to /include/dialog/config.php that close the generated script tag and inject JavaScript, which executes in the victim's browser.

A vulnerability was found in DedeCMS up to 5.7.118 in an unknown function of the file plus/mytag_js.php. Manipulation of the argument aid leads to code injection. The attack can be launched remotely and the exploit has been made public.

A flaw has been found in DeDeCMS 3. Affected by this vulnerability is an unknown functionality of the file /include/dialog/select_media_post.php. Executing a manipulation of the argument uploadfile can lead to unrestricted upload. The attack can be executed remotely. The exploit has been published and may be used.

A security vulnerability has been detected in DeDeCMS 53_1_UTF8. This vulnerability affects unknown code of the file /plus/advancedsearch.php. Such manipulation of the argument sql leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

A vulnerability was found in DedeCMS up to version 5.7.118 UTF8SP2, leading to file inclusion in the _4_Setup function of the file install/index.php in the Installation Wizard component. The attack can be executed remotely but is characterized by high complexity and difficult exploitability. The exploit has been publicly disclosed.

A path traversal vulnerability has been discovered in DedeCMS 5.7.118 in the ExtractFile function of include/zip.class.php, used in the Album Publishing Feature. Manipulation of the filename argument allows remote exploitation.

A security flaw was discovered in DedeCMS 5.7.118 in the file /plus/search.php within the Column Management component. Manipulating the Column Name argument allows remote code injection. The exploit has been publicly released and may be used in attacks.

A security flaw in DedeCMS 5.7.88 affects the RemoveXSS function in /plus/carbuyaction.php. Manipulation of postname/des arguments leads to SQL injection. The attack can be launched remotely and the exploit is publicly available.

A vulnerability in DedeCMS 5.7.88 affects the dede_htmlspecialchars function in /plus/flink.php. Manipulation of the msg argument leads to SQL injection. The attack can be initiated remotely and the exploit is publicly available.

A vulnerability was determined in DedeCMS 5.7.88. The affected element is the function TrimMsg of the file /plus/feedback.php of the component Feedback Handler. Executing a manipulation of the argument msg can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

A Server-Side Request Forgery (SSRF) vulnerability was found in DedeCMS 5.7.88 in the file /plus/download.php?open=1. The base64_decode function manipulates the Link argument, allowing a remote attacker to send requests from the server to internal resources. The exploit is publicly available.

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/makehtml_list_action.php. The vulnerability allows performing unwanted actions on behalf of a logged-in user.

A vulnerability was identified in DedeCMS up to 5.7.118. This impacts an unknown function of the file /freelist_main.php. Manipulation of the argument orderby leads to SQL injection, and the attack can be initiated remotely.

DedeCMS v5.7.111 was found to have a reflective cross-site scripting (XSS) vulnerability in the select_media_post_wangEditor.php component. An attacker can inject malicious JavaScript code into a request, which will be executed in the victim's browser.

A critical vulnerability was found in DedeCMS version 5.7.110, affecting unknown code in the file /uploads/tags.php. Manipulation of the argument tag_alias leads to SQL injection.

DedeCMS versions up to and including 5.7.110 contain a cross-site scripting (XSS) vulnerability in /dede/freelist_edit.php via the title parameter.

DedeCMS versions up to and including 5.7.110 contain a cross-site scripting (XSS) vulnerability in /dede/freelist_add.php via the title parameter.

DedeCMS versions up to and including 5.7.110 were found to contain multiple cross-site scripting (XSS) vulnerabilities in /dede/vote_edit.php via the votename and votenote parameters.

DedeCMS versions up to and including 5.7.110 were found to contain multiple cross-site scripting (XSS) vulnerabilities in /dede/vote_add.php triggered by the votename and voteitem1 parameters.

DedeCMS version 5.7.109 has a File Upload vulnerability, leading to remote code execution (RCE).

A critical vulnerability was found in DedeCMS version 5.7.109, affecting an unknown functionality of the file co_do.php. Manipulation of the argument rssurl leads to server-side request forgery.