SZB-866c4d9627
DedeCMS file inclusion flaw in carbuyaction.php listed as EUVD-2010-5325
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- DedeCMS
- Product
- DeDeCMS
- First seen
Summary
The EUVD record EUVD-2010-5325 describes a file inclusion vulnerability in plus/carbuyaction.php in DedeCMS before 5.7, with a CVSS v3.1 score of 8.7. It states that remote unauthenticated attackers can control the include path through the code parameter.
If you use DedeCMS
Upgrade DedeCMS to version 5.7 or later
Restrict access to the plus/ directory until patched
Review web server logs for requests to carbuyaction.php
What the sources say 1
· Mastodon: “DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php” Source