Vulnerability · Published Nov 12, 2024 · Assigned by VulDB
CVE-2024-11138DedeCMS friendlink_add.php unrestricted upload
Low 2.7
In plain English
A low-severity unrestricted file upload in DedeCMS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 85% of all known vulnerabilities).
Severity (CVSS 3.1)2.7Low
Exploit odds (30 days)2.6%top 14.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability classified as problematic has been found in DedeCMS 5.7.116. This affects an unknown part of the file /dede/uploads/dede/friendlink_add.php. The manipulation of the argument logoimg leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Affected products (as reported)
Weakness: CWE-434, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
References
- VDB-283977 | DedeCMS friendlink_add.php unrestricted upload vdb-entry, technical-description
- VDB-283977 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #441900 | 上海卓卓网络科技有限公司 DedeCMS(Content management system) V5.7.116 Remote Code Excute third-party-advisory
- https://github.com/falling-snow1/cve1/blob/main/DedeCMS%20V5.7.116%20has%20Remote%20Code%20Excute%20vulnerability.md exploit