CVE-2018-18608: XSS

Published Oct 23, 2018

Updated

DedeCMS 5.7 SP2 allows XSS via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at the bottom of some templates, as demonstrated by the PATHINFO to /member/index.php, /member/pm.php, /member/contentlist.php, or /plus/feedback.php.

Affected Software

1 affected component

DedeCMS Dedecms=5.7-sp2

Event History

Oct 23, 2018

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2018-18608?

CVE-2018-18608 has a medium severity rating due to its potential for exploiting cross-site scripting (XSS) vulnerabilities.

How do I fix CVE-2018-18608?

To fix CVE-2018-18608, it is recommended to sanitize user inputs in the 'GetPageList' function to prevent XSS.

What software versions are affected by CVE-2018-18608?

CVE-2018-18608 affects DedeCMS version 5.7 SP2.

What type of vulnerability is CVE-2018-18608?

CVE-2018-18608 is classified as a Cross-Site Scripting (XSS) vulnerability.

Can CVE-2018-18608 be exploited remotely?

Yes, CVE-2018-18608 can be exploited remotely by injecting malicious scripts through user input.