DedeCMS < 5.7 File Inclusion via plus/carbuyaction.php
DedeCMS versions before 5.7 are affected through plus/carbuyaction.php when the dopost parameter is set to return. The issue is fixed in 5.7.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in 5.7
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: yes
- Technical impact: partial
Summary
DedeCMS, a content management system used to build websites, is affected. A remote attacker without a login could use the vulnerable payment-related script to read arbitrary files on the server, potentially exposing sensitive data.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating the uninitialized code parameter passed to require_once. Attackers can supply path traversal sequences ../../ to include arbitrary local files outside the intended payment directory, potentially achieving local file disclosure. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: poc · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- DedeCMS DedeCMS
fixed in 5.7
References 6
cnblogs.com
GitHub · projectdiscovery/nuclei-templates
GitHub · dedecms/DedeCMS
Questions about CVE-2010-20125
What does this mean?
The plus/carbuyaction.php page can be made to include a local file through the code parameter using path traversal. Where an uploaded file contains PHP code, that code can be executed.Source: cnblogs.com, web.archive.org
Am I affected, and how do I check?
DedeCMS versions before 5.7 are in the affected range. The vulnerable branch runs only when the request sets dopost to return, so check your installed DedeCMS version and whether that page is reachable.Source: cnblogs.com, web.archive.org
What should I do about it?
Upgrade DedeCMS to 5.7 or later, which is the first fixed version.Source: cnblogs.com, web.archive.org
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.Source: cve.now feed data