References https://vuldb.com/zh/?id.258923 https://avd.aliyun.com/detail?id=AVD-2024-3148 https://nvd.nist.gov/vuln/detail/CVE-2024-3148 https://cn-sec.com/archives/2623706.html https://cn-sec.com/archives/2626141.html https://www.aqtd.com/nd.jsp?id=6267 https://blog.csdn.net/shelter1234567/article/details/137461436 https://avd.aliyun.com/product?prod=dedecms&page=2 https://github.com/Shelter1234/VulneraLab
Related VulnerabilitiesPoCCVE-2024-57241: DedeCMS - Open Redirect via download.phpPoC(CVE-2025-15004)DedeCMS至5.7.118版本freelist_main.php文件orderby参数SQL注入漏洞PoCCVE-2017-17731: DedeCMS 5.7 - SQL InjectionPoCCVE-2018-18608: DedeCMS 5.7 SP2 - Cross-Site ScriptingPoCCVE-2018-6910: DedeCMS 5.7 - Path DisclosurePoCCVE-2018-7700: DedeCMS 5.7SP2 - Cross-Site Request Forgery/Remote Code ExecutionPoCCVE-2023-2059: DedeCMS 5.7.87 - Directory TraversalPoCCVE-2023-3578: DedeCMS 5.7.109 - Server-Side Request ForgeryPoCCVE-2023-49494: DedeCMS v5.7.111 - Cross-Site ScriptingPoCCVE-2018-6910: DedeCMS 5.7 Web Path DisclosurePoCCVE-2018-7700: Dedecms V5.7 后台任意代码执行PoCdedecms-carbuyaction-fileinclude: DedeCmsV5.6 Carbuyaction Fileinclude