CVE-2024-11138

DedeCMS friendlink_add.php unrestricted upload

State: Published
Severity: 5.1 Medium
Published: Nov 12, 2024
Updated: Nov 13, 2024
Reserved: Nov 12, 2024

Description

A vulnerability classified as problematic has been found in DedeCMS 5.7.116. This affects an unknown part of the file /dede/uploads/dede/friendlink_add.php. The manipulation of the argument logoimg leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N	VulDB
3.1	2.7 Low	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L	VulDB
3.0	2.7 Low	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L	VulDB
2.0	3.3 Low	AV:N/AC:L/Au:M/C:N/I:N/A:P	VulDB

Weaknesses

CWE-434 Unrestricted Upload
CWE-284 Improper Access Controls

Affected Products

Product	Versions
DedeCMSn/a	5.7.116Affected

References

VDB-283977 | DedeCMS friendlink_add.php unrestricted uploadvdb-entrytechnical-description
VDB-283977 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #441900 | 上海卓卓网络科技有限公司 DedeCMS(Content management system) V5.7.116 Remote Code Excutethird-party-advisory
https://github.com/falling-snow1/cve1/blob/main/DedeCMS%20V5.7.116%20has%20Remote%20Code%20Excute%20vulnerability.mdexploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.