by Kastro
Paper/Archive/CVE-2024-11138

CVE-2024-11138

dedecms dedecms — DedeCMS friendlink_add.php unrestricted upload

EPSS 3%public exploitCVSS 9.8
critical.is priorityof 100
57
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 85.4.854 × 2017.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A vulnerability classified as problematic has been found in DedeCMS 5.7.116. This affects an unknown part of the file /dede/uploads/dede/friendlink_add.php. The manipulation of the argument logoimg leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Affected

ProductAffectedFixed inSource
DedeCMS5.7.116–CNA
dedecms5.7.116–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulDB (CNA)5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
VulDB (CNA)2.7CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
VulDB (CNA)2.7CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

writeupvuldb.com/?id.283977refvuldb.com/?ctiid.283977writeupvuldb.com/?submit.441900exploitgithub.com/falling-snow1/cve1/blob/main/DedeCMS%20V5.7.116%20has%20Remote%20Code%20Excute%20vulnerability.md