Design/Logic Flaw

2018-09-2115:29:00

PRIOn knowledge base

www.prio-n.com

7.2 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

58.9%

DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a “<file type=‘file’ name='…/” substring.

CPENameOperatorVersion
dedecmseq5.7 sp2

CPE	Name	Operator	Version
	dedecms	eq	5.7 sp2

References

github.com/ky-j/dedecms/issues/3