CVE-2018-9174: Code Injection
Published Apr 2, 2018
·Updated
sysverifies.php in DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the refiles array parameter, because the contents of modifytmp.inc are under an attacker's control.
Affected Software
1 affected component
DedeCMS Dedecms=5.7
Event History
Apr 2, 2018
CVE Published
via MITRE·03:00 AM
Data Sourced
via MITRE·03:00 AM
Description
Data Sourced
via NVD·03:29 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2018-9174?
CVE-2018-9174 is rated as a critical severity vulnerability due to the potential for remote code execution.
2
How do I fix CVE-2018-9174?
To fix CVE-2018-9174, update DedeCMS to the latest version where this vulnerability is patched.
3
What versions of DedeCMS are affected by CVE-2018-9174?
CVE-2018-9174 affects DedeCMS version 5.7.
4
What type of attacks can be executed through CVE-2018-9174?
CVE-2018-9174 allows remote attackers to execute arbitrary PHP code due to improper validation of the refiles array parameter.
5
Is there any workaround for CVE-2018-9174 if I cannot update DedeCMS?
If you cannot update DedeCMS, a temporary workaround is to restrict access to the vulnerable script, although this is not a permanent solution.