CVE-2018-9134: CSRF
Published Mar 30, 2018
·Updated
filemanagecontrol.php in DedeCMS 5.7 has CSRF in an fmdo=rename action, as demonstrated by renaming an arbitrary file under uploads/userup to a .php file under the web root to achieve PHP code execution. This uses the oldfilename and newfilename parameters.
Affected Software
1 affected component
DedeCMS Dedecms=5.7
Event History
Mar 30, 2018
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Data Sourced
via NVD·04:29 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2018-9134?
CVE-2018-9134 is considered a critical vulnerability due to the potential for remote PHP code execution.
2
How do I fix CVE-2018-9134?
To mitigate CVE-2018-9134, you should upgrade DedeCMS to a patched version that fixes the CSRF vulnerability.
3
What type of vulnerability is CVE-2018-9134?
CVE-2018-9134 is a Cross-Site Request Forgery (CSRF) vulnerability affecting DedeCMS.
4
Which versions of DedeCMS are affected by CVE-2018-9134?
CVE-2018-9134 specifically affects DedeCMS version 5.7.
5
What exploit can occur due to CVE-2018-9134?
CVE-2018-9134 allows an attacker to rename files, potentially executing arbitrary PHP code on the server.