2058 matches found
CVE-2018-12046
DedeCMS through 5.7SP2 allows arbitrary file write in dede/filemanagecontrol.php via a dede/filemanageview.php?fmdo=newfile request with name and str parameters, as demonstrated by writing to a new .php file...
CVE-2018-12045
CVE-2018-12045 affects Desdev DedeCMS up to version 5.7SP2. The flaw is in dede/file_manage_control.php where a request to dede/file_manage_view.php?fmdo=upload with parameter upfile1 can upload arbitrary files (e.g., PHP). This could enable an attacker to place executable code on the server. The...
DedeCMS Arbitrary File Upload Vulnerability
Desdev DedeCMS Dream Weaving Content Management System is China's Zhuozhuo Network Desdev Technology Co., Ltd. of a set of open-source set of content publishing, editing, management and retrieval of PHP Web site content management system CMS. A security vulnerability exists in the file...
PT-2018-10966
Name of the Vulnerable Software and Affected Versions DedeCMS versions prior to V5.7SP2 Description The issue allows for arbitrary file upload. This can be achieved by sending a request to the /dede/file manage view.php?fmdo=upload endpoint with a malicious upfile1 parameter, enabling the upload ...
CVE-2018-12045: Unrestricted Upload of File with Dangerous Type
DedeCMS through V5.7SP2 allows arbitrary file upload in dede/filemanagecontrol.php via a dede/filemanageview.php?fmdo=upload request with an upfile1 parameter, as demonstrated by uploading a .php file...
DedeCMS Arbitrary File Write Vulnerability
Desdev DedeCMS Dream Weaving Content Management System is China's Zhuozhuo network Desdev Technology Co., Ltd. of a set of open-source set of content publishing, editing, management and retrieval of PHP Web site content management system CMS. A security vulnerability exists in the file...
PT-2018-10967
Name of the Vulnerable Software and Affected Versions DedeCMS versions prior to 5.7SP2 Description The issue allows for arbitrary file write in dede/file manage control.php via a "dede/file manage view.php?fmdo=newfile" request with name and str parameters. This can be exploited to write to a new...
CVE-2018-12046: Improper Input Validation
DedeCMS through 5.7SP2 allows arbitrary file write in dede/filemanagecontrol.php via a dede/filemanageview.php?fmdo=newfile request with name and str parameters, as demonstrated by writing to a new .php file...
Code Execution Vulnerability in DedeCMS Backend
Dream Content Management System DedeCMS is a PHP open source website management system. A code execution vulnerability exists in the DedeCMS backend. An attacker can exploit the vulnerability to execute arbitrary PHP code...
Renaming Vulnerability in DedeCMS v5.7 SP2 Version
Shanghai Zhuozhuo Network Technology Co., Ltd Desdev Inc, is a professional web content management solutions provider, its products - Dream Content Management System DedeCms is one of the most used CMS in China. A renaming vulnerability exists in DedeCMS V5.7 SP2, which allows an attacker to obta...
DedeCMS File Upload Vulnerability (CNVD-2018-10173)
Desdev DedeCMS Dream Weaving Content Management System is China's Zhuozhuo network Desdev Technology Co., Ltd. of a set of open-source set of content publishing, editing, management and retrieval is equal to one of the PHP Web site content management system CMS. A security vulnerability exists in...
CVE-2018-10375
A file uploading vulnerability exists in /include/helpers/upload.helper.php in DedeCMS V5.7 SP2, which can be utilized by attackers to upload and execute arbitrary PHP code via the /dede/archivesdo.php?dopost=uploadLitpic litpic parameter when "Content-Type: image/jpeg" is sent, but the filename...
Design/Logic Flaw
A file uploading vulnerability exists in /include/helpers/upload.helper.php in DedeCMS V5.7 SP2, which can be utilized by attackers to upload and execute arbitrary PHP code via the /dede/archivesdo.php?dopost=uploadLitpic litpic parameter when "Content-Type: image/jpeg" is sent, but the filename...
CVE-2018-10375
A file uploading vulnerability exists in /include/helpers/upload.helper.php in DedeCMS V5.7 SP2, which can be utilized by attackers to upload and execute arbitrary PHP code via the /dede/archivesdo.php?dopost=uploadLitpic litpic parameter when "Content-Type: image/jpeg" is sent, but the filename...
CVE-2018-10375
A file uploading vulnerability exists in /include/helpers/upload.helper.php in DedeCMS V5.7 SP2, which can be utilized by attackers to upload and execute arbitrary PHP code via the /dede/archivesdo.php?dopost=uploadLitpic litpic parameter when "Content-Type: image/jpeg" is sent, but the filename...
CVE-2018-10375
CVE-2018-10375 affects DedeCMS v5.7 SP2. A vulnerability in /include/helpers/upload.helper.php allows an attacker to upload a crafted file through /dede/archives_do.php?dopost=uploadLitpic with Content-Type: image/jpeg; the filename ends in .php and contains PHP code, enabling arbitrary PHP code ...
PT-2018-9857
Name of the Vulnerable Software and Affected Versions: DedeCMS version V5.7 SP2 Description: A file uploading issue exists, allowing attackers to upload and execute arbitrary PHP code. This can be achieved via the /dede/archives do.php?dopost=uploadLitpic endpoint, specifically through the litpic...
CVE-2018-10375: Unrestricted Upload of File with Dangerous Type
A file uploading vulnerability exists in /include/helpers/upload.helper.php in DedeCMS V5.7 SP2, which can be utilized by attackers to upload and execute arbitrary PHP code via the /dede/archivesdo.php?dopost=uploadLitpic litpic parameter when "Content-Type: image/jpeg" is sent, but the filename...
File Upload Vulnerability in DedeCMS v5.7 SP2
Dream Content Management System DedeCMS is a PHP open source website management system. A file upload vulnerability exists in the uploads/include/uploadsafe.inc.php file in DedeCMS V5.7 SP2, which can be exploited by an attacker to upload script files and obtain a webshell...