CVE-2026-116253: DedeCMS Advertisement Rendering ad_js.php _RunMagicQuotes code injection
A vulnerability was determined in DedeCMS 5.7.118. This vulnerability affects the function common.inc.php::RunMagicQuotes of the file plus/adjs.php of the component Advertisement Rendering. Executing a manipulation of the argument aid can lead to code injection. The attack can be executed remotely.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The issue is remotely exploitable and requires no privileges or user interaction according to the supplied vector. An attacker able to send requests to the affected DedeCMS advertisement-rendering endpoint is the relevant threat model.
What input is involved in exploitation?
Exploitation involves manipulating the aid argument handled by plus/ad_js.php. The vulnerable processing is identified as common.inc.php::_RunMagicQuotes.
What is the potential impact?
Successful exploitation can result in code injection. The supplied severity vector rates confidentiality, integrity, and availability impact as low.
Which version is identified as affected?
The provided data identifies DedeCMS version 5.7.118 as affected. No fix version or workaround is provided.