CVE-2017-17731

A weakness was identified in DedeCMS up to 5.7.118 in the require_once function of dede/update_guide.php. Manipulating the vtime argument causes code injection. Remote exploitation is possible and the exploit has been made public.

DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templet parameter to member/article_edit.php.

DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to /plus/flink.php?dopost=save with an empty validation code to execute arbitrary PHP and system commands.

A command execution vulnerability in DedeCMS V5.7.118 in file_manage_control.php allows an attacker to execute arbitrary commands on the server.

Remote Code Execution vulnerability in DedeCMS through version 5.7.109 allows an attacker to execute arbitrary code via a crafted POST request to /dede/tpl.php.

DedeCMS v5.7.109 has an arbitrary file upload vulnerability in /dede/file_manage_control.php that allows attackers to execute arbitrary code by uploading a crafted PHP file.

DedeCMS versions up to 5.7 are vulnerable to SQL Injection via the logo parameter in plus/flink_add.php.

DedeCMS 5.6 and 5.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input to the adminDirHand parameter. Attackers can send crafted GET requests to /include/dialog/config.php that close the generated script tag and inject JavaScript, which executes in the victim's browser.

A vulnerability was found in DedeCMS up to 5.7.118 in an unknown function of the file plus/mytag_js.php. Manipulation of the argument aid leads to code injection. The attack can be launched remotely and the exploit has been made public.

A flaw has been found in DeDeCMS 3. Affected by this vulnerability is an unknown functionality of the file /include/dialog/select_media_post.php. Executing a manipulation of the argument uploadfile can lead to unrestricted upload. The attack can be executed remotely. The exploit has been published and may be used.