CVE-2023-5301 - DedeCMS album_add.php AddMyAddon os command injection

Back Back to CVE browser

HIGH

DedeCMS album_add.php AddMyAddon os command injection

Published Sep 30, 2023

8.8

HIGH

CVSS 3.1

EPSS 7.46%

Description

A vulnerability classified as critical was found in DedeCMS 5.7.111. This vulnerability affects the function AddMyAddon of the file album_add.php. The manipulation of the argument albumUploadFiles leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240940.

Affected products

Vendor n/a Product DedeCMS Default
n/a
- Version
  5.7.111
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

DedeCMS

n/a

Version	Status	Constraints
5.7.111	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-57624
Advisory
https://github.com/Lamber-maybe/cve/blob/main/DedeCMS%20V5.7.111%20Remote%20Code%20Execution%20Vulnerability.md
exploit
https://vuldb.com/?ctiid.240940
signaturepermissions-requiredPermissions RequiredThird Party AdvisoryVDB Entry
https://vuldb.com/?id.240940
vdb-entrytechnical-descriptionPermissions RequiredThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-57624		Advisory
https://github.com/Lamber-maybe/cve/blob/main/DedeCMS%20V5.7.111%20Remote%20Code%20Execution%20Vulnerability.md		exploit
https://vuldb.com/?ctiid.240940		signaturepermissions-requiredPermissions RequiredThird Party AdvisoryVDB Entry
https://vuldb.com/?id.240940		vdb-entrytechnical-descriptionPermissions RequiredThird Party AdvisoryVDB Entry