Critical PHP Injection Flaw in DedeCMS Allows Remote Code Execution
Unauthenticated attackers can exploit CVE-2021-48016 in DedeCMS versions up to 5.8.1-beta to execute arbitrary PHP code via crafted HTTP headers.
Key points
- The vulnerability is rated CVSS 9.3 Critical and involves PHP code injection.
- Exploitation was first observed by the Shadowserver Foundation on October 14, 2023.
- Attackers target the ShowMsg function by manipulating the HTTP Referer header.
Unauthenticated attackers can execute arbitrary PHP code and system commands on servers running DedeCMS versions up to 5.8.1-beta. This critical vulnerability, identified as CVE-2021-48016, allows remote exploitation through a specific endpoint that processes user input without sufficient validation.
At a glance
- CVE
- CVE-2021-48016
- Product
- DedeCMS
- CVSS
- 9.3 Critical
- Weakness
- code injection
- Exploited
- No known exploitation
The flaw exists within the ShowMsg() function, which improperly handles the HTTP Referer header. According to the National Vulnerability Database record, the header value is written into a DedeTemplate string and subsequently included in the application logic. This behavior classifies the issue under CWE-94, indicating improper control of generation of code.
Context and Background
The National Vulnerability Database assigns a CVSS score of 9.3 to this vulnerability, rating it as Critical. The high severity reflects the ease of exploitation and the significant impact on system integrity. Attackers do not need valid credentials to trigger the flaw, making any exposed instance a potential target.
Evidence of active exploitation was first observed by the Shadowserver Foundation on October 14, 2023. This observation confirms that the vulnerability is being actively targeted in the wild, despite being assigned a CVE ID in 2021. The gap between disclosure and observed abuse highlights the persistence of unpatched systems.
Who Is Affected
DedeCMS instances running version 5.8.1-beta or earlier are affected by this vulnerability. The flaw specifically impacts the /plus/flink.php endpoint when the dopost parameter is set to save. Attackers can send a crafted HTTP request with an empty validate code to trigger the injection.
That suggests administrators must verify their current version immediately, as even beta releases remain vulnerable. The combination of unauthenticated access and remote code execution capabilities makes this a high-priority remediation target for any organization using this content management system.
What should you do?
Organizations should audit their web servers to identify any installations of DedeCMS. If the software is in use, administrators must check the version number against the affected range. Systems running version 5.8.1-beta or lower are at risk and require immediate attention.
What to do and how to stay safe: DedeCMS
- Verify the installed version of DedeCMS on all web servers to determine if it falls within the affected range of up to 5.8.1-beta.
- Monitor web server logs for requests to the /plus/flink.php endpoint, specifically looking for unusual HTTP Referer headers or empty validate codes.
- Restrict access to administrative and script endpoints using firewall rules or web application firewalls to limit exposure to unauthenticated users.
- Once the vendor provides an update, apply the patch immediately to remediate the PHP code injection vulnerability and close the attack vector.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2021-48016?
The National Vulnerability Database rates CVE-2021-48016 with a CVSS score of 9.3, which is considered Critical.
Which versions of DedeCMS are vulnerable to this flaw?
DedeCMS versions up to and including 5.8.1-beta are affected by this PHP code injection vulnerability.
When was exploitation of this vulnerability first observed?
The Shadowserver Foundation first observed exploitation evidence for this vulnerability on October 14, 2023.
