DedeCMS: PHP code injection in ShowMsg() (CVE-2021-48016)

DedeCMS versions through 5.8.1-beta are vulnerable to PHP code injection within the ShowMsg() function. The vulnerability arises because the application improperly handles the HTTP Referer header, writing it directly into a DedeTemplate string before inclusion. An unauthenticated attacker can exploit this by sending a crafted HTTP request to the '/plus/flink.php?dopost=save' endpoint with an empty validate code field. Successful exploitation results in arbitrary PHP and system command execution. This vulnerability has been subject to in-the-wild exploitation since at least October 14, 2023.

Attack Chain

1. Attacker identifies a target running DedeCMS 5.8.1-beta or earlier.
2. Attacker crafts a malicious HTTP request targeting '/plus/flink.php?dopost=save'.
3. Attacker includes a malicious payload within the 'Referer' header.
4. Attacker ensures the 'validate' parameter is empty to bypass simple verification.
5. The server-side ShowMsg() function processes the crafted 'Referer' header.
6. The application writes the 'Referer' value into a template string and includes it.
7. Arbitrary PHP code injected in the 'Referer' header is executed by the server.

Impact

Successful exploitation allows unauthenticated remote attackers to execute arbitrary PHP code and system commands on the underlying host, potentially leading to full system compromise.

Recommendation

• Inventory all internet-facing instances of DedeCMS.
• Patch affected instances immediately; confirm if the vendor has provided a specific update that remediates the ShowMsg() injection vulnerability.
• If a patch is unavailable, restrict access to '/plus/flink.php' at the web application firewall or reverse proxy level.
• Enable detailed web server logging to capture 'Referer' headers and audit requests to the 'flink.php' endpoint for anomalous payloads containing PHP tags or shell commands.