PT-2010-2813 · Dede · Dedecms

Published 2010-03-24 · Updated 2010-12-14 · CVE-2010-1097

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DeDeCMS version 5.5 GBK

Description The issue allows remote attackers to bypass authentication and gain administrative access. This is achieved by setting the SESSION[dede admin id] parameter to 1 when session.auto start is enabled. An example of exploitation is a request to "uploads/include/dialog/select soft post.php".

Recommendations For DeDeCMS version 5.5 GBK, consider disabling the session.auto start feature to prevent exploitation. Additionally, restrict access to the "uploads/include/dialog/select soft post.php" endpoint to minimize the risk of unauthorized administrative access. Avoid using the SESSION[dede admin id] parameter in sensitive operations until the issue is resolved.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2010-1097

Affected Products

Dedecms

References · 6

• 🔥 http://securityfocus.com/bid/38469 · Exploit
• 🔥 http://bbs.wolvez.org/topic/125 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-1097 · Security Note
• http://secunia.com/advisories/38790 · Vendor Advisory
• http://osvdb.org/62622 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1097 · Note