PT-2019-18988 · Dedecms · Dedecms

Published 2019-02-16 · Updated 2019-02-20 · CVE-2019-8362

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions DedeCMS versions through V5.7SP2

Description The issue allows for arbitrary file upload in certain PHP files. This can be achieved by sending a request to specific API endpoints, such as "/dede/album edit.php" or "/dede/album add.php", with a ZIP archive containing a malicious file, for example, "1.jpg.php". The input validation is insufficient, as it only checks for the presence of certain substrings like ".jpg", ".png", or ".gif" in the file name, without verifying the file's content or name.

Recommendations For DedeCMS versions through V5.7SP2, consider disabling the upload functionality in dede/album edit.php and dede/album add.php until a patch is available. Restrict access to these files to minimize the risk of exploitation. Avoid using the formzip parameter in the affected API endpoints until the issue is resolved.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2019-8362

Affected Products

Dedecms

References · 3

• 🔥 http://tusk1.cn/2019/02/16/dedecms%20v5.7%20sp2%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E · Exploit
• https://osv.dev/vulnerability/CVE-2019-8362 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-8362 · Security Note