1703 matches found
Design/Logic Flaw
DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templet parameter to member/articleedit.php...
Sql injection
DedeCMS through 5.7 has SQL Injection via the logo parameter to plus/flinkadd.php...
CVE-2017-17730
DedeCMS through 5.7 has SQL Injection via the logo parameter to plus/flinkadd.php...
CVE-2017-17731
DedeCMS through 5.7 has SQL Injection via the $FILES superglobal to plus/recommend.php...
CVE-2017-17731
DedeCMS through 5.7 has SQL Injection via the $FILES superglobal to plus/recommend.php...
CVE-2017-17727
CVE-2017-17727 affects DedeCMS 5.6 and earlier. Affected component: template handling in member/article_edit.php; root cause: insufficient validation in the templet parameter allows embedding PHP code within a .jpg file, enabling arbitrary file upload and PHP code execution. Documented impact: re...
CVE-2017-17731
DedeCMS 5.7 is affected by an SQL injection in plus/recommend.php via the $_FILES superglobal. The vulnerability allows execution of arbitrary SQL through crafted file-upload input, with potential data leakage or manipulation. Remediation is to apply the latest security patch or upgrade to a newe...
CVE-2017-17730
DedeCMS through 5.7 has SQL Injection via the logo parameter to plus/flinkadd.php...
CVE-2017-17727
DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templet parameter to member/articleedit.php...
CVE-2017-17730
DedeCMS ≤ 5.7 is affected by a SQL Injection vulnerability in the logo parameter of plus/flink_add.php. The issue stems from unsanitized input in that parameter, enabling potential SQL injection. Severity is reflected in CVE data (NVD: high/critical depending on metric). No explicit remediation o...
Desdev DedeCMS SQL Injection Vulnerability
Desdev DedeCMS Dream Weaving Content Management System is China's Zhuozhuo network Desdev Technology Co., Ltd. of a set of open-source set of content publishing, editing, management and retrieval is equal to one of the PHP Web site content management system CMS. A SQL injection vulnerability exis...
Desdev DedeCMS SQL Injection Vulnerability (CNVD-2018-01088)
Desdev DedeCMS Dream Weaving Content Management System is China's Zhuozhuo network Desdev Technology Co., Ltd. of a set of open-source set of content publishing, editing, management and retrieval is equal to one of the PHP Web site content management system CMS. A SQL injection vulnerability exis...
dedecms最新版本后台getshell
官方下载最新安装包http://updatenew.dedecms.com/base-v57/package/DedeCMS-V5.7-UTF8-SP2.tar.gz 环境：Linux+phpstudy 上传图片抓包 POST /dedecms/include/dialog/selectimagespost.php?CKEditor=body&CKEditorFuncNum=2&langCode=zh-cn HTTP/1.1 Host: Content-Length: 42080 Cache-Control: max-age=0 Origin: http://...
DEDECMS member center code submit defects can getshell
Preface : dedecms this year to update a lot of patches,the present article selected 20170315 patch for learning and research. Body: From the official website to download DEDECMS 20170315 patch using DIFF comparison tools for comparison: See the Red part, the servermsg1 variables appearing in dede...
csrf vulnerability in dedecms v5.7 latest version
Dedecms is an open source PHP open source website management system. A csrf vulnerability exists in the latest version of dedecms v5.7. Allows attackers to exploit the vulnerability to forge form links and trick administrators to click and add backend accounts...
DedeCMS stored xss vulnerability
Vulnerability description: Dedecms is an open source PHP open source website management system. Dedecms member function shopsdelivery. in php des parameters there is stored XSS vulnerability, the attacker may exploit the vulnerability to obtain the users cookie. Test environment: DedeCMS-V5...
Dedecms presence of a stored cross site scripting vulnerability
Vulnerability description: Dedecms is an open source PHP open source website management system. Dedecms member function carbuyaction. php in the address, des, email, postname parameters there is stored XSS vulnerability, the attacker may exploit the vulnerability to obtain the administrator cooki...
Stored Cross-Site Scripting Vulnerability in Dedecms
Dedecms is an open source PHP open source website management system. A stored XSS vulnerability exists in the address, des parameters of the Dedecms membership function carbuyaction.php, which can be exploited by attackers to obtain an administrator cookie...
Dedecms CSRF Vulnerability
Dedecms is an open source PHP open source website management system. Dedecms has a CSRF vulnerability that allows an attacker to exploit the vulnerability to perform unauthorized operations as an administrator and delete the account of any user...