CVE-2024-35510

The vulnerability exists in the /dede/file_manage_control.php script, which does not impose sufficient restrictions on the type or content of uploaded files. An attacker can upload a crafted file (e.g., PHP webshell) without needing special privileges or victim interaction. After successfully uploading such a file to the server, the attacker can remotely trigger its execution by the web server, thereby gaining full control over the application.

An attacker can remotely execute arbitrary code on the server (RCE), leading to complete takeover of the application and potentially the entire server – confidentiality, integrity, and system availability are compromised.

Patches available from the vendor should be applied according to references. As a temporary measure, it is recommended to restrict access to the /dede/ directory exclusively to trusted IP addresses at the firewall or web server configuration level, and to disable file upload and execution capabilities in user directories.

DedeCMS v5.7.114