CVE-2018-9175

DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the egroup parameter to uploads/dede/stepselect_main.php because code within the database is accessible to uploads/dede/sys_cache_up.php.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cve@mitre.org

Published

2018-04-02

Last modified

2024-08-05

Weaknesses

CWE-94

Affected products

• Dedecms (Dedecms)

References

• https://xz.aliyun.com/t/2237