Remote Code Injection Vulnerability in DedeCMS

DedeCMS versions up to and including 5.7.118 are vulnerable to a remote code injection flaw located in the 'plus/mytag_js.php' file. The vulnerability stems from improper input validation of the 'aid' argument, which allows an unauthenticated attacker to inject and execute arbitrary code on the target server. Because the vulnerability is reachable via standard HTTP GET requests to the identified file, it poses a high risk to installations of the affected content management system. Proof-of-concept exploit code has been publicly disclosed, increasing the likelihood of opportunistic exploitation by threat actors. Organizations hosting DedeCMS should verify their version and restrict access to the 'plus/mytag_js.php' endpoint or apply vendor-provided patches.

Impact

Successful exploitation of this vulnerability results in unauthenticated remote code execution (RCE) on the web server hosting DedeCMS. This allows an attacker to gain full control over the application, access sensitive database information, exfiltrate user data, or use the compromised server as a pivot point for further lateral movement within the network.

Recommendation

• Prioritize the identification of all internet-facing DedeCMS instances in the environment.
• Upgrade all DedeCMS installations to a version beyond 5.7.118 immediately.
• Implement web application firewall (WAF) rules to block HTTP requests to '/plus/mytag_js.php' containing suspicious characters (e.g., shell metacharacters or alphanumeric strings designed to trigger code execution) in the 'aid' parameter.
• Review web server logs for HTTP requests targeting the 'plus/mytag_js.php' file with unusual values in the query string to identify attempted exploitation.