CoreCVE
Back

HIGH

file_manage_control.php in DedeCMS 5.7 has CSRF in an fmdo=rename action, as demonstrated by renaming an arbitrary file under uploads/userup to a .php file under the web root to achieve PHP code execution

Published Mar 30, 2018

Description

file_manage_control.php in DedeCMS 5.7 has CSRF in an fmdo=rename action, as demonstrated by renaming an arbitrary file under uploads/userup to a .php file under the web root to achieve PHP code execution. This uses the oldfilename and newfilename parameters.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (1)

CWE-352

CSRF

References (2)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Mar 30, 2018
Updated Aug 5, 2024
Reserved Mar 30, 2018
Link CVE-2018-9134
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2018-9134
Red Hat
Severity n/a
Public date n/a
Links CVE-2018-9134