CVE-2021-48016— DedeCMS 5.8.1-beta Unauthenticated RCE via plus/flink.php
Quick assessment
Affected
DedeCMS DedeCMS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
DedeCMS 5.8.1-beta 及以下版本存在 PHP 代码注入漏洞。该漏洞位于 函数中，其将 HTTP 请求头内容写入 DedeTemplate 字符串并执行 操作。未认证的攻击者可向 发送精心构造的 头，并配合空的验证码，从而执行任意 PHP 代码和系统命令。Shadowserver Foundation 于 2023 年 10 月 14 日首次观测到该漏洞被利用的证据。
Possible ATT&CK Techniques 3 AI
T1059 · Command and Scripting Interpreter T1059.006 · Python T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-48016
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
DedeCMS 5.8.1-beta Unauthenticated RCE via plus/flink.php
Source: CVE Program / CVE List V5
Vulnerability Description
DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to /plus/flink.php?dopost=save with an empty validate code to execute arbitrary PHP and system commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2021-48016
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-48016
请登录查看更多情报信息。
Other References for CVE-2021-48016 (4)
-
https://srcincite.io/blog/2021/09/30/chasing-a-dream-pwning-the-biggest-cms-in-china.html technical-description exploit
-
https://github.com/dedecms/DedeCMS/blob/v5.8.1/include/common.func.php technical-description
IV. Related Vulnerabilities
Same product: DedeCMS
-
CVE-2014-125131
DedeCMS 5.6 / 5.7 Reflected XSS via adminDirHand in config.p -
CVE-2026-94004
DedeCMS mytag_js.php code injection -
CVE-2026-76800
DeDeCMS select_media_post.php unrestricted upload -
CVE-2026-76783
DeDeCMS advancedsearch.php sql injection -
CVE-2026-19353
DedeCMS Installation Wizard index.php _4_Setup file inclusio
Same weakness: CWE-94
-
CVE-2026-76293
Remote Code Execution (RCE) through Splunk Web Manager Exten -
CVE-2026-92207
MindsDB OpenBBtable Code Injection Remote Code Execution Vul -
CVE-2026-114125
Storybook: Missing origin validation in Storybook preview al -
CVE-2026-76494
Cisco Expressway Series Software Hardening Release: October -
CVE-2026-114053
vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_re
V. Comments for CVE-2021-48016
No comments yet