VYPR
← All advisories
High severity8.8NVD Advisory· Published Mar 30, 2018· Updated Jun 17, 2026

CVE-2018-9134

CVE-2018-9134

Description

file_manage_control.php in DedeCMS 5.7 has CSRF in an fmdo=rename action, as demonstrated by renaming an arbitrary file under uploads/userup to a .php file under the web root to achieve PHP code execution. This uses the oldfilename and newfilename parameters.

Affected products

2
  • Dedecms/Dedecms2 versions
    cpe:2.3:a:dedecms:dedecms:5.7:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:dedecms:dedecms:5.7:*:*:*:*:*:*:*
    • (no CPE)range: = 5.7

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.