提交 #748709: DedeCMS CMS V5.7.118 Cross Site Scripting

In DedeCMS V5.7.118, a Cross-Site Scripting (XSS) vulnerability exploitable through the search field functionality, as presented in the action_search.php file, was identified. The flaw occurs due to the lack of proper validation and sanitization of user-supplied data, allowing the injection of malicious JavaScript code.

An attacker can exploit this vulnerability by inserting an XSS payload directly into the search field, causing the injected code to be processed and executed in the victim's browser when a request is handled or a response is displayed. As a proof of concept (PoC), the following payload was successfully executed: <script>alert(1)</script>

Upon submitting this payload through the search functionality, the JavaScript code is successfully executed, resulting in an alert being displayed in the browser, confirming the exploitation of the XSS vulnerability.

• 来源: ⚠️ http://localhost/dedecms/dede/
• 用户: mirandaBR (UID 90010)
• 提交: 2026-01-29 03時02分 (8 月前)
• 管理: 2026-02-01 09時20分 (3 days later)
• 状态: 重复
• VulDB条目: 175098 [DeDeCMS 5.7 SP2 action_search.php keyword 跨网站脚本]
• 积分: 0