CVE-2024-35375

The vulnerability (CWE-434) results from insufficient validation of uploaded file types on the 'media add.php' page in the DedeCMS backend. An attacker can upload a file with malicious content (e.g., PHP webshell) while impersonating an allowed file type. Once such a file is placed on the server, it can be executed remotely through an appropriate HTTP request.

Successful exploitation of the vulnerability allows an attacker to execute code remotely (RCE) on the server, which may result in complete system takeover, data theft, backdoor installation, or further lateral movement in the network.

Apply patches available from the vendor according to the references. Additionally, it is recommended to restrict access to the administration panel only to trusted IP addresses and implement file type control mechanisms at the web server and Web Application Firewall (WAF) level.

DedeCMS version 5.7.114