CVE-2023-2928 DedeCMS article_allowurl_edit.php code injection
Remote attackers with permissions can inject code via the allurls argument in DedeCMS article_allowurl_edit.php, leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-2928?
CVE-2023-2928 is a medium-severity code injection vulnerability in Dedecms Dedecms, published on 27 May 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability was found in DedeCMS up to 5.7.106. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file uploads/dede/article_allowurl_edit.php. The manipulation of the argument allurls leads to code injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230083.
Weakness: CWE-94
Which versions are affected by CVE-2023-2928?
It affects 1 product.
Products include Dedecms Dedecms.
How do I fix CVE-2023-2928?
No fix has been published for CVE-2023-2928 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-2928 being exploited?
There is no known exploitation of CVE-2023-2928 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Dedecms Dedecms
Sources
Also known as GHSA-m47h-qxcc-5fhx.