CVE-2014-125131

DedeCMS versions 5.6 and 5.7 are vulnerable to a reflected cross-site scripting (XSS) flaw. The issue exists in the config.php file because the adminDirHand parameter does not properly sanitize input. An unauthenticated attacker can send a crafted GET request to /include/dialog/config.php , closi...