1697 matches found
CVE-2018-12045
DedeCMS through V5.7SP2 allows arbitrary file upload in dede/filemanagecontrol.php via a dede/filemanageview.php?fmdo=upload request with an upfile1 parameter, as demonstrated by uploading a .php file...
CVE-2018-12046
DedeCMS through 5.7SP2 allows arbitrary file write in dede/filemanagecontrol.php via a dede/filemanageview.php?fmdo=newfile request with name and str parameters, as demonstrated by writing to a new .php file...
Design/Logic Flaw
DedeCMS through 5.7SP2 allows arbitrary file write in dede/filemanagecontrol.php via a dede/filemanageview.php?fmdo=newfile request with name and str parameters, as demonstrated by writing to a new .php file...
Default credentials
DedeCMS through V5.7SP2 allows arbitrary file upload in dede/filemanagecontrol.php via a dede/filemanageview.php?fmdo=upload request with an upfile1 parameter, as demonstrated by uploading a .php file...
CVE-2018-12045
DedeCMS through V5.7SP2 allows arbitrary file upload in dede/filemanagecontrol.php via a dede/filemanageview.php?fmdo=upload request with an upfile1 parameter, as demonstrated by uploading a .php file...
CVE-2018-12046
DedeCMS through 5.7SP2 allows arbitrary file write in dede/filemanagecontrol.php via a dede/filemanageview.php?fmdo=newfile request with name and str parameters, as demonstrated by writing to a new .php file...
CVE-2018-12046
The CVE-2018-12046 entry concerns DedeCMS up to version 5.7SP2. A flaw in dede/file_manage_control.php allows arbitrary file write via a request to dede/file_manage_view.php?fmdo=newfile, passing name and str parameters to write a new PHP file. This is the stated vulnerability and impact in the p...
CVE-2018-12045
CVE-2018-12045 affects Desdev DedeCMS up to version 5.7SP2. The flaw is in dede/file_manage_control.php where a request to dede/file_manage_view.php?fmdo=upload with parameter upfile1 can upload arbitrary files (e.g., PHP). This could enable an attacker to place executable code on the server. The...
DedeCMS Arbitrary File Write Vulnerability
Desdev DedeCMS Dream Weaving Content Management System is China's Zhuozhuo network Desdev Technology Co., Ltd. of a set of open-source set of content publishing, editing, management and retrieval of PHP Web site content management system CMS. A security vulnerability exists in the file...
DedeCMS Arbitrary File Upload Vulnerability
Desdev DedeCMS Dream Weaving Content Management System is China's Zhuozhuo Network Desdev Technology Co., Ltd. of a set of open-source set of content publishing, editing, management and retrieval of PHP Web site content management system CMS. A security vulnerability exists in the file...
Code Execution Vulnerability in DedeCMS Backend
Dream Content Management System DedeCMS is a PHP open source website management system. A code execution vulnerability exists in the DedeCMS backend. An attacker can exploit the vulnerability to execute arbitrary PHP code...
Renaming Vulnerability in DedeCMS v5.7 SP2 Version
Shanghai Zhuozhuo Network Technology Co., Ltd Desdev Inc, is a professional web content management solutions provider, its products - Dream Content Management System DedeCms is one of the most used CMS in China. A renaming vulnerability exists in DedeCMS V5.7 SP2, which allows an attacker to obta...
DedeCMS File Upload Vulnerability (CNVD-2018-10173)
Desdev DedeCMS Dream Weaving Content Management System is China's Zhuozhuo network Desdev Technology Co., Ltd. of a set of open-source set of content publishing, editing, management and retrieval is equal to one of the PHP Web site content management system CMS. A security vulnerability exists in...
CVE-2018-10375
A file uploading vulnerability exists in /include/helpers/upload.helper.php in DedeCMS V5.7 SP2, which can be utilized by attackers to upload and execute arbitrary PHP code via the /dede/archivesdo.php?dopost=uploadLitpic litpic parameter when "Content-Type: image/jpeg" is sent, but the filename...
CVE-2018-10375
A file uploading vulnerability exists in /include/helpers/upload.helper.php in DedeCMS V5.7 SP2, which can be utilized by attackers to upload and execute arbitrary PHP code via the /dede/archivesdo.php?dopost=uploadLitpic litpic parameter when "Content-Type: image/jpeg" is sent, but the filename...
Design/Logic Flaw
A file uploading vulnerability exists in /include/helpers/upload.helper.php in DedeCMS V5.7 SP2, which can be utilized by attackers to upload and execute arbitrary PHP code via the /dede/archivesdo.php?dopost=uploadLitpic litpic parameter when "Content-Type: image/jpeg" is sent, but the filename...
CVE-2018-10375
A file uploading vulnerability exists in /include/helpers/upload.helper.php in DedeCMS V5.7 SP2, which can be utilized by attackers to upload and execute arbitrary PHP code via the /dede/archivesdo.php?dopost=uploadLitpic litpic parameter when "Content-Type: image/jpeg" is sent, but the filename...
CVE-2018-10375
CVE-2018-10375 affects DedeCMS v5.7 SP2. A vulnerability in /include/helpers/upload.helper.php allows an attacker to upload a crafted file through /dede/archives_do.php?dopost=uploadLitpic with Content-Type: image/jpeg; the filename ends in .php and contains PHP code, enabling arbitrary PHP code ...
File Upload Vulnerability in DedeCMS v5.7 SP2
Dream Content Management System DedeCMS is a PHP open source website management system. A file upload vulnerability exists in the uploads/include/uploadsafe.inc.php file in DedeCMS V5.7 SP2, which can be exploited by an attacker to upload script files and obtain a webshell...