Vulnerability · Published Jul 21, 2024 · Assigned by VulDB

CVE-2024-6940DedeCMS article_template_rand.php code injection

Medium 4.7

In plain English

A medium-severity code injection in DedeCMS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)0.7%top 47.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in DedeCMS 5.7.114. It has been classified as critical. This affects an unknown part of the file article_template_rand.php. The manipulation leads to code injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-271995. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
n/a	DedeCMS	5.7.114

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

References

VDB-271995 | DedeCMS article_template_rand.php code injection vdb-entry
VDB-271995 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #372810 | DedeCMS 5.7.114 Code Injection third-party-advisory
https://gitee.com/fushuling/cve/blob/master/dedeCMS%20V5.7.114%20article_template_rand.php%20code%20injection.md exploit