| Package | Affected versions | Patched versions |
|---|---|---|
| dedecms | = 5.7 |
file_manage_control.php in DedeCMS 5.7 has CSRF in an fmdo=rename action, as demonstrated by renaming an arbitrary file under uploads/userup to a .php file under the web root to achieve PHP code execution. This uses the oldfilename and newfilename parameters.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free