Reflected Cross-Site Scripting Vulnerability in DedeCMS by Dede

CVE-2014-125131

What is CVE-2014-125131?

DedeCMS versions 5.6 and 5.7 are affected by a reflected cross-site scripting vulnerability that enables attackers to exploit unsanitized input within the adminDirHand parameter. By crafting specific GET requests to the /include/dialog/config.php endpoint, an attacker can inject malicious JavaScript code. This code is then executed in the victim's browser, potentially leading to unauthorized actions or information theft. The first evidence of exploitation was reported by the Shadowserver Foundation on October 23, 2023.

References