Code Injection Vulnerability in DedeCMS 5.7.117
CVE-2025-5137

5.1MEDIUM

Key Information:

Vendor: DedeCMS
Status: Dedecms
Vendor: CVE Published:; 25 May 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-5137?

A code injection vulnerability has been identified in DedeCMS version 5.7.117, stemming from an incomplete fix related to a previous issue (CVE-2018-9175). Specifically, the vulnerability resides in the functionality of the file 'dede/sys_verifies.php?action=getfiles', where improper handling of the 'refiles' parameter allows an attacker to inject malicious code. This vulnerability can be exploited remotely, making it crucial for administrators to address the issue to prevent potential unauthorized access and control over the system.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

DedeCMS 5.7.117

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-5137 - Proof of Concept