Description
DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to /plus/flink.php?dopost=save with an empty validate code to execute arbitrary PHP and system commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| DedeCMS | DedeCMS | ≤ 5.8.1-beta | — |
References
- Source Incite Blog technical-description exploit
- DedeCMS v5.8.1 common.func.php ShowMsg technical-description
- Nuclei Template technical-description
- VulnCheck Advisory: DedeCMS 5.8.1-beta Unauthenticated RCE via plus/flink.php third-party-advisory