PT-2009-6033 · Dedecms · Dedecms

Published 2009-10-27 · Updated 2018-10-10 · CVE-2009-3806

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DedeCMS version 5.1

Description A SQL injection issue exists, allowing remote attackers to execute arbitrary SQL commands. This is achieved via the arcurl parameter in the feedback js.php file.

Recommendations For DedeCMS version 5.1, avoid using the arcurl parameter in the feedback js.php file until a patch is available. As a temporary workaround, consider restricting access to the feedback js.php file to minimize the risk of exploitation.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2009-3806

Affected Products

Dedecms

References · 4

• 🔥 https://exploit-db.com/exploits/9876 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3806 · Security Note
• http://securityfocus.com/archive/1/507109/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3806 · Note