CVE-2019-8933: Malicious File Upload

Published Feb 19, 2019

Updated

In DedeCMS 5.7SP2, attackers can upload a .php file to the uploads/ directory (without being blocked by the Web Application Firewall), and then execute this file, via this sequence of steps: visiting the management page, clicking on the template, clicking on Default Template Management, clicking on New Template, and modifying the filename from ../index.html to ../index.php.

Affected Software

1 affected component

DedeCMS Dedecms=5.7-sp2

Event History

Feb 19, 2019

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2019-8933?

CVE-2019-8933 is considered a critical vulnerability due to its ability to allow remote code execution.

How do I fix CVE-2019-8933?

To fix CVE-2019-8933, upgrade DedeCMS to a version that is not affected, specifically any version beyond 5.7SP2.

What kind of attack does CVE-2019-8933 enable?

CVE-2019-8933 enables attackers to upload and execute malicious PHP files on the server.

What systems are affected by CVE-2019-8933?

CVE-2019-8933 affects DedeCMS version 5.7SP2.

Can CVE-2019-8933 be exploited without authentication?

Yes, CVE-2019-8933 can be exploited without authentication if the attacker accesses the management interface.