| शीर्षक | DedeCMS CMS V5.7.118 file_manage_view.php Reflected Cross Site Scripting |
|---|
| विवरण | In DedeCMS version V5.7.118, a reflected Cross-Site Scripting (XSS) vulnerability was identified in the file management functionality, located in the “Auxiliary Plugins” menu.
During the analysis of requests with Burp Suite, it was observed that the value of the `activepath` parameter is reflected directly in the application's front-end without proper validation or sanitization. Based on this finding, it was possible to manipulate the parameter and inject malicious JavaScript code, which is rendered and executed in the user's browser.
An attacker can exploit this flaw by inducing an authenticated user to access a URL containing a malicious payload, enabling, for example, the redirection of users to external pages, in addition to other malicious actions.
Proof of Concept (PoC)
file_manage_view.php?fmdo=newdir&activepath="><img src=1 onerror=alert(1)>
Exploitation of this Reflected XSS vulnerability is only possible through an account with administrative privileges, since the affected functionality requires authentication. |
|---|
| स्रोत | ⚠️ http://localhost/dedecms/dede/file_manage_view.php?fmdo=newdir&activepath=%22%3E%3Cimg%20src=1%20onerror=alert(1)%3E |
|---|
| उपयोगकर्ता | mirandaBR (UID 90010) |
|---|
| सबमिशन | 29/01/2026 08:45 PM (8 महीनों पहले) |
|---|
| संयम | 01/02/2026 09:38 AM (3 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 185279 [DedeCMS 7.5 SP2 file_manage_view.php क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 0 |
|---|