1697 matches found
CVE-2017-17731
DedeCMS 5.7 is affected by an SQL injection in plus/recommend.php via the $_FILES superglobal. The vulnerability allows execution of arbitrary SQL through crafted file-upload input, with potential data leakage or manipulation. Remediation is to apply the latest security patch or upgrade to a newe...
CVE-2017-17731
DedeCMS through 5.7 has SQL Injection via the $FILES superglobal to plus/recommend.php...
CVE-2017-17730
DedeCMS ≤ 5.7 is affected by a SQL Injection vulnerability in the logo parameter of plus/flink_add.php. The issue stems from unsanitized input in that parameter, enabling potential SQL injection. Severity is reflected in CVE data (NVD: high/critical depending on metric). No explicit remediation o...
CVE-2017-17730
DedeCMS through 5.7 has SQL Injection via the logo parameter to plus/flinkadd.php...
Desdev DedeCMS SQL Injection Vulnerability (CNVD-2018-01088)
Desdev DedeCMS Dream Weaving Content Management System is China's Zhuozhuo network Desdev Technology Co., Ltd. of a set of open-source set of content publishing, editing, management and retrieval is equal to one of the PHP Web site content management system CMS. A SQL injection vulnerability exis...
Desdev DedeCMS SQL Injection Vulnerability
Desdev DedeCMS Dream Weaving Content Management System is China's Zhuozhuo network Desdev Technology Co., Ltd. of a set of open-source set of content publishing, editing, management and retrieval is equal to one of the PHP Web site content management system CMS. A SQL injection vulnerability exis...
dedecms最新版本后台getshell
官方下载最新安装包http://updatenew.dedecms.com/base-v57/package/DedeCMS-V5.7-UTF8-SP2.tar.gz 环境：Linux+phpstudy 上传图片抓包 POST /dedecms/include/dialog/selectimagespost.php?CKEditor=body&CKEditorFuncNum=2&langCode=zh-cn HTTP/1.1 Host: Content-Length: 42080 Cache-Control: max-age=0 Origin: http://...
DEDECMS member center code submit defects can getshell
Preface : dedecms this year to update a lot of patches,the present article selected 20170315 patch for learning and research. Body: From the official website to download DEDECMS 20170315 patch using DIFF comparison tools for comparison: See the Red part, the servermsg1 variables appearing in dede...
csrf vulnerability in dedecms v5.7 latest version
Dedecms is an open source PHP open source website management system. A csrf vulnerability exists in the latest version of dedecms v5.7. Allows attackers to exploit the vulnerability to forge form links and trick administrators to click and add backend accounts...
DedeCMS stored xss vulnerability
Vulnerability description: Dedecms is an open source PHP open source website management system. Dedecms member function shopsdelivery. in php des parameters there is stored XSS vulnerability, the attacker may exploit the vulnerability to obtain the users cookie. Test environment: DedeCMS-V5...
Dedecms presence of a stored cross site scripting vulnerability
Vulnerability description: Dedecms is an open source PHP open source website management system. Dedecms member function carbuyaction. php in the address, des, email, postname parameters there is stored XSS vulnerability, the attacker may exploit the vulnerability to obtain the administrator cooki...
Stored Cross-Site Scripting Vulnerability in Dedecms
Dedecms is an open source PHP open source website management system. A stored XSS vulnerability exists in the address, des parameters of the Dedecms membership function carbuyaction.php, which can be exploited by attackers to obtain an administrator cookie...
Dedecms CSRF Vulnerability
Dedecms is an open source PHP open source website management system. Dedecms has a CSRF vulnerability that allows an attacker to exploit the vulnerability to perform unauthorized operations as an administrator and delete the account of any user...
DedeCMS /member/buy_action.php SQL注入漏洞
No description provided by source...
DedeCMS /member/reg_new.php SQL注入漏洞
No description provided by source...
dedecms v5.7缓存文件data/cache/typename.inc导致任意代码执行（有条件）
No description provided by source...
dedecms referer xss跨站
简要描述： dedecms 全版本！xss跨站一枚! referer构造触发！ 详细说明： 文件：/plus/vote.php code 区域 $ENVGOBACKURL = empty$SERVER'HTTPREFERER' ? '':$SERVER'HTTPREFERER'; ............................................ //判断是否允许被查看 $admin = new userLogin; if$dopost == 'view' if$row'view' == 1 && empty$admin-userName...
DedeCMS 5.7 plus/guestbook.php 注入漏洞
No description provided by source...
Dedecms远程写文件漏洞
来源链接：http://seclists.org/fulldisclosure/2015/Jun/47 http://blog.nsfocus.net/dedecms-write-file-vuln/ 0x00 漏洞概述2015年6月17日seclists网站上公布了Dedecms的一个远程getshell漏洞细节，造成这个漏洞的原因也有些让人玩味。官方已在2015年6月18日发布了修复版本，下载链接：http://www.dedecms.com/products/dedecms/downloads/本篇文章将分析这个漏洞的成因，并给出触发利用方法。0x01...