What’s Vulnerable › Vulnerabilities

CVE-2018-9134

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-03-30 · updated 2026-06-17
• Weakness: CWE-352

Description

file_manage_control.php in DedeCMS 5.7 has CSRF in an fmdo=rename action, as demonstrated by renaming an arbitrary file under uploads/userup to a .php file under the web root to achieve PHP code execution. This uses the oldfilename and newfilename parameters.

Affected products

• DedeCMS: 5.7

References

• https://xz.aliyun.com/t/2234
• https://exchange.xforce.ibmcloud.com/vulnerabilities/141335
• https://xz.aliyun.com/t/2234

Get alerted when CVE-2018-9134 or the next vulnerability affects your stack