EUVD-2021-34899

DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to /plus/flink.php?dopost=save with an empty validate code to execute arbitrary...