CVE-2018-12046

Name of the Vulnerable Software and Affected Versions DedeCMS versions prior to 5.7SP2

Description The issue allows for arbitrary file write in dede/file manage control.php via a "dede/file manage view.php?fmdo=newfile" request with name and str parameters. This can be exploited to write to a new .php file.

Recommendations For DedeCMS versions prior to 5.7SP2, consider disabling the file management functionality in dede/file manage control.php until a patch is available. Restrict access to the dede/file manage view.php endpoint to minimize the risk of exploitation. Avoid using the name and str parameters in the affected API endpoint until the issue is resolved.