CVE-2021-48016 in DedeCMS
Summary
by MITRE • 10/22/2026
DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to /plus/flink.php?dopost=save with an empty validate code to execute arbitrary PHP and system commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in DedeCMS versions through 5.8.1-beta represents a critical server-side security flaw rooted in improper input validation and unsafe file inclusion practices within the application's core messaging function, specifically ShowMsg(). This architecture allows unauthenticated remote attackers to achieve arbitrary PHP code execution and subsequent operating system command injection. The root cause lies in how the CMS handles HTTP headers during specific administrative or semi-administrative operations. When a user interacts with the /plus/flink.php endpoint using the dopost=save parameter, the application processes the request without requiring authentication if the validation code field is left empty. This design oversight creates an entry point for malicious actors to manipulate server-side logic by injecting payload data through standard HTTP headers rather than direct form fields or URL parameters that might be more heavily scrutinized.
The technical mechanism of exploitation centers on the manipulation of the HTTP Referer header. The ShowMsg() function, which is typically responsible for displaying message prompts to users after an action, inadvertently writes the value of the HTTP Referer header directly into a DedeTemplate string variable. In many content management systems, template engines are designed to render static or dynamic text but should not execute code contained within variables unless explicitly configured to do so via specific tags. However, in this instance, the inclusion mechanism allows for PHP evaluation when the injected payload contains valid PHP syntax. By crafting a Referer header that includes executable PHP code, an attacker can bypass standard input filtering mechanisms because headers are often treated as metadata rather than user data subject to strict sanitization rules. This leads directly to Remote Code Execution (RCE), granting the attacker full control over the web server process running DedeCMS.
From a classification perspective, this vulnerability aligns with CWE-94, which describes Improper Control of Generation of Code or Script commonly known as code injection. More specifically, it exhibits characteristics of CWE-502, Deserialization of Untrusted Data, if the template engine interprets the injected string as executable logic rather than plain text. In terms of offensive security frameworks such as MITRE ATT&CK, this exploit maps to T1190 Exploit Public-Facing Application and potentially T1059 Command and Scripting Interpreter for the subsequent execution of system commands once PHP code is successfully evaluated. The ability to execute arbitrary system commands escalates the severity from a simple web application compromise to full server takeover, allowing attackers to install backdoors, exfiltrate sensitive database contents, pivot into internal networks, or deploy ransomware across affected infrastructure.
The operational impact of this vulnerability is severe due to its unauthenticated nature and widespread observation in the wild. The fact that exploitation evidence was first observed by the Shadowserver Foundation on October 14, 2023, indicates active targeting campaigns against vulnerable instances globally. Attackers likely utilize automated scanners to identify DedeCMS installations with open flink.php endpoints lacking proper validation checks. Once exploited, the attacker gains persistent access under the context of the web server user, which often has read and write permissions for the CMS directory structure. This enables long-term persistence mechanisms such as creating new administrative accounts, modifying existing files to maintain backdoors, or leveraging local privilege escalation vulnerabilities if the web server runs with elevated system privileges. The lack of authentication requirement means that any internet-facing instance running a vulnerable version is immediately susceptible without needing prior credentials or social engineering efforts.
Mitigation strategies must prioritize immediate remediation through software updates and configuration hardening. The primary defense is to upgrade DedeCMS to a patched version where the ShowMsg() function has been modified to sanitize input from HTTP headers before inclusion in template strings, ensuring that special characters are escaped and PHP tags are neutralized. If upgrading is not immediately feasible, administrators should implement web application firewall rules to block requests containing suspicious patterns in the Referer header when targeting /plus/flink.php with dopost=save. Additionally, enforcing strict validation code requirements for all form submissions can prevent this specific attack vector from succeeding even if other protections are bypassed. Regular monitoring of server logs for anomalous HTTP headers and unusual PHP error messages related to template parsing failures can aid in early detection of exploitation attempts. Securing the /plus directory with IP whitelisting or additional authentication layers further reduces the attack surface by restricting access to administrative functions that should not be publicly accessible without proper verification.