CVE-2014-125131: DedeCMS 5.6 / 5.7 Reflected XSS via adminDirHand in config.php
DedeCMS 5.6 and 5.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input to the adminDirHand parameter. Attackers can send crafted GET requests to /include/dialog/config.php that close the generated script tag and inject JavaScript, which executes in the victim's browser. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-23.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of DedeCMS 5.6 or 5.7 that expose /include/dialog/config.php to users who can be induced to open a crafted GET request are affected. The attacker does not need to authenticate, but a victim must load the malicious URL for the script to execute.
What access does an attacker need?
The attacker needs network access to send a crafted GET request to /include/dialog/config.php with a malicious adminDirHand parameter. No account or prior privileges are required.
How can I check whether an instance is vulnerable?
Confirm whether the site runs DedeCMS 5.6 or 5.7 and whether /include/dialog/config.php is reachable. The issue is triggered when adminDirHand input is reflected into generated script content without sanitization.