CVE-2018-10375: Malicious File Upload

Published Apr 25, 2018

Updated

A file uploading vulnerability exists in /include/helpers/upload.helper.php in DedeCMS V5.7 SP2, which can be utilized by attackers to upload and execute arbitrary PHP code via the /dede/archivesdo.php?dopost=uploadLitpic litpic parameter when "Content-Type: image/jpeg" is sent, but the filename ends in .php and contains PHP code.

Affected Software

1 affected component

DedeCMS Dedecms=5.7-sp2

Event History

Apr 25, 2018

CVE Published

via MITRE·09:00 AM

Data Sourced

via MITRE·09:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2018-10375?

CVE-2018-10375 is classified as a high-severity vulnerability due to the potential for remote code execution.

How do I fix CVE-2018-10375?

To fix CVE-2018-10375, update to a patched version of DedeCMS that addresses the file upload vulnerability.

What software versions are affected by CVE-2018-10375?

CVE-2018-10375 affects DedeCMS version 5.7 SP2.

What type of attack does CVE-2018-10375 facilitate?

CVE-2018-10375 allows attackers to upload and execute arbitrary PHP code on vulnerable systems.

Is CVE-2018-10375 a common vulnerability in web applications?

Yes, file upload vulnerabilities like CVE-2018-10375 are common in web applications and can lead to severe security risks.