VYPR
← All advisories
Unrated severityNVD Advisory· Published Feb 19, 2019· Updated Sep 16, 2024

CVE-2019-8933

CVE-2019-8933

Description

In DedeCMS 5.7SP2, attackers can upload a .php file to the uploads/ directory (without being blocked by the Web Application Firewall), and then execute this file, via this sequence of steps: visiting the management page, clicking on the template, clicking on Default Template Management, clicking on New Template, and modifying the filename from ../index.html to ../index.php.

Affected products

2
  • Dedecms/Dedecmsinferred2 versions
    = 5.7SP2+ 1 more
    • (no CPE)range: = 5.7SP2
    • (no CPE)range: = 5.7SP2

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.