PT-2024-32876 · Dedecms · Dedecms

Gatsby · Published 2024-05-11 · Updated 2024-07-06 · CVE-2024-4790

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions DedeCMS version 5.7.114

Description A problematic vulnerability has been found in DedeCMS, affecting the file /sys verifies.php?action=view. The manipulation of the filename argument with the input ../../../../../etc/passwd leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Recommendations For DedeCMS version 5.7.114, patch immediately to prevent potential file disclosure and monitor for exploit attempts. As a temporary workaround, consider restricting access to the /sys verifies.php?action=view endpoint until a patch is available. Avoid using the filename argument in the affected endpoint until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

CWE-24

Related Identifiers

CVE-2024-4790

Affected Products

Dedecms

References · 8

• 🔥❌ https://github.com/gatsby2003/DedeCms/blob/main/Directory_traversal_arbitrary_file_read.md · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2024-4790 · Security Note
• https://osv.dev/vulnerability/CVE-2024-4790 · Vendor Advisory
• https://twitter.com/oktsec/status/1809726415937458564 · Twitter Post
• https://vuldb.com/?ctiid.263889 · Note
• https://vuldb.com/?id.263889 · Note
• https://vuldb.com/?submit.329483 · Note
• https://t.me/cvenotify/83922 · Telegram Post