CVE-2022-44118

Vulnerability

DedeCMSV6 version 6.1.9 contains a remote code execution vulnerability in file_manage_control.php. The exact nature of the flaw is not detailed, but it allows an attacker to execute arbitrary PHP code on the server. [1]

Exploitation

An attacker can exploit this vulnerability by sending a crafted HTTP request to the file_manage_control.php endpoint. The required privileges or authentication level are not specified in the available references. [1]

Impact

Successful exploitation results in remote code execution, enabling the attacker to execute arbitrary commands with the privileges of the web server, leading to full compromise of the application and potentially the underlying system. [1]

Mitigation

As of the publication date (2022-11-23), no official patch or workaround has been released by the vendor. Users are advised to monitor for updates or consider restricting access to the vulnerable file.