CVE-2021-48016: DedeCMS 5.8.1-beta Unauthenticated RCE via plus/flink.php
DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to /plus/flink.php?dopost=save with an empty validate code to execute arbitrary PHP and system commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker only needs network access to the affected DedeCMS endpoint. Exploitation is unauthenticated and uses a crafted HTTP Referer header in a request to /plus/flink.php?dopost=save with an empty validate code.
Are internet-accessible installations at immediate risk?
Yes. The vulnerability has network attack vector, requires low complexity, no privileges, and no user interaction, and it permits arbitrary PHP and system command execution. Exploitation evidence was observed by the Shadowserver Foundation on 2023-10-14.
Which versions are affected?
The available information states that DedeCMS through version 5.8.1-beta is affected.