PT-2024-15234 · Dedecms · Dedecms

Alphabug · Published 2024-01-07 · Updated 2024-05-17 · CVE-2023-7212

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DeDeCMS versions up to 5.7.112

Description A critical vulnerability has been found in DeDeCMS, affecting an unknown function of the file file class.php in the Backend component. This vulnerability leads to unrestricted upload and can be exploited remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted about this disclosure but did not respond.

Recommendations For DeDeCMS versions up to 5.7.112, as a temporary workaround, consider disabling the affected function in the file class.php file until a patch is available. Restrict access to the Backend component to minimize the risk of exploitation. Avoid using the vulnerable function in the Backend component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-7212

Affected Products

Dedecms

References · 9

• 🔥 https://hmxwjm7x03.feishu.cn/docx/FPjhdYcQvocR4gxy34Rc0pmon5e?from=from_copylink · Exploit
• https://osv.dev/vulnerability/CVE-2023-7212 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-7212 · Security Note
• https://twitter.com/CVEnew/status/1744039261001630004 · Twitter Post
• https://t.me/cvenotify/67096 · Telegram Post
• https://vuldb.com/?ctiid.249768 · Note
• https://t.me/cvenotify/66535 · Telegram Post
• https://vuldb.com/?id.249768 · Note
• https://twitter.com/VulmonFeeds/status/1744078920960413816 · Twitter Post