EUVD-2014-9824

DedeCMS 5.6 and 5.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input to the adminDirHand parameter. Attackers can send crafted GET requests to /include/dialog/config.php that close the generated script ta...

CVE-2014-125131

DedeCMS versions 5.6 and 5.7 are vulnerable to a reflected cross-site scripting (XSS) flaw. The issue exists in the config.php file because the adminDirHand parameter does not properly sanitize input. An unauthenticated attacker can send a crafted GET request to /include/dialog/config.php , closi...

DedeCMS 5.7 config.php 跨站脚本漏洞

dedecms 5.7 config.php 跨站脚本漏洞 \include\dialog\config.php $cuserLogin = new userLogin; if$cuserLogin-getUserID 提示：需输入后台管理目录才能登录请输入后台管理目录名：", "javascript:;"; exit; $gurl = "../../$adminDirHand/login.php?gotopage=".urlencode$dedeNowurl; echo "location='$gurl';"; exit; 对用户提交的$adminDirHand...