PT-2019-19268 · Dedecms · Dedecms

Published 2019-02-19 · Updated 2019-02-20 · CVE-2019-8933

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DedeCMS version 5.7SP2

Description The issue allows attackers to upload a .php file to the uploads/ directory and then execute it. This can be achieved by visiting the management page, clicking on the template, clicking on Default Template Management, clicking on New Template, and modifying the filename from ../index.html to ../index.php.

Recommendations For DedeCMS version 5.7SP2, consider restricting access to the template management functionality and the uploads/ directory to prevent unauthorized file uploads and executions. As a temporary workaround, consider disabling the template upload feature until a patch is available.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2019-8933

Affected Products

Dedecms

References · 3

• 🔥 https://blog.csdn.net/qq_36093477/article/details/86681178 · Exploit
• https://osv.dev/vulnerability/CVE-2019-8933 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-8933 · Security Note