VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Apr 2, 2018· Updated Jun 17, 2026

CVE-2018-9175

CVE-2018-9175

Description

DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the egroup parameter to uploads/dede/stepselect_main.php because code within the database is accessible to uploads/dede/sys_cache_up.php.

Affected products

3
  • Dedecms/Dedecmsinferred3 versions
    =5.7.0+ 2 more
    • (no CPE)range: =5.7.0
    • cpe:2.3:a:dedecms:dedecms:5.7:*:*:*:*:*:*:*
    • (no CPE)range: =5.7

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.