VYPR
← All advisories
High severity8.8NVD Advisory· Published Feb 19, 2019· Updated Jun 17, 2026

CVE-2019-8933

CVE-2019-8933

Description

In DedeCMS 5.7SP2, attackers can upload a .php file to the uploads/ directory (without being blocked by the Web Application Firewall), and then execute this file, via this sequence of steps: visiting the management page, clicking on the template, clicking on Default Template Management, clicking on New Template, and modifying the filename from ../index.html to ../index.php.

Affected products

3
  • Dedecms/Dedecmsinferred3 versions
    = 5.7SP2+ 2 more
    • (no CPE)range: = 5.7SP2
    • cpe:2.3:a:dedecms:dedecms:5.7:sp2:*:*:*:*:*:*
    • (no CPE)range: 5.7SP2

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.