CVE-2019-6289 - uploads/include/dialog/select_soft.php in DedeCMS V57_UTF8_SP2 allows remote attackers to execute arbitrary PHP code by uploading with a safe file extension and then renaming with a mixed-case variation of the .php extension, as demonstrated by the 1.pHP filename

Back Back to CVE browser

HIGH

uploads/include/dialog/select_soft.php in DedeCMS V57_UTF8_SP2 allows remote attackers to execute arbitrary PHP code by uploading with a safe file extension and then renaming with a mixed-case variation of the .php extension, as demonstrated by the 1.pHP filename

Published Jan 15, 2019

8.8

HIGH

CVSS 3.0

EPSS 1.93%

Description

uploads/include/dialog/select_soft.php in DedeCMS V57_UTF8_SP2 allows remote attackers to execute arbitrary PHP code by uploading with a safe file extension and then renaming with a mixed-case variation of the .php extension, as demonstrated by the 1.pHP filename.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-178

CWE-706

References (1)

https://laolisafe.com/dedecms/
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://laolisafe.com/dedecms/		x_refsource_MISCThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Jan 15, 2019

Updated Aug 4, 2024

Reserved Jan 14, 2019

Link CVE-2019-6289

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-6289

Red Hat

Severity n/a

Public date n/a

Links CVE-2019-6289