{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/dedecms--5.8.1-beta/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:dedecms:dedecms:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2021-48016"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=CVE-2021-48016\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["DedeCMS (\u003c= 5.8.1-beta)"],"_cs_severities":["critical"],"_cs_tags":["php-injection","remote-code-execution","web-application-vulnerability"],"_cs_type":"threat","_cs_vendors":["DedeCMS"],"content_html":"\u003cp\u003eDedeCMS versions through 5.8.1-beta are vulnerable to PHP code injection within the ShowMsg() function. The vulnerability arises because the application improperly handles the HTTP Referer header, writing it directly into a DedeTemplate string before inclusion. An unauthenticated attacker can exploit this by sending a crafted HTTP request to the '/plus/flink.php?dopost=save' endpoint with an empty validate code field. Successful exploitation results in arbitrary PHP and system command execution. This vulnerability has been subject to in-the-wild exploitation since at least October 14, 2023.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target running DedeCMS 5.8.1-beta or earlier.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious HTTP request targeting '/plus/flink.php?dopost=save'.\u003c/li\u003e\n\u003cli\u003eAttacker includes a malicious payload within the 'Referer' header.\u003c/li\u003e\n\u003cli\u003eAttacker ensures the 'validate' parameter is empty to bypass simple verification.\u003c/li\u003e\n\u003cli\u003eThe server-side ShowMsg() function processes the crafted 'Referer' header.\u003c/li\u003e\n\u003cli\u003eThe application writes the 'Referer' value into a template string and includes it.\u003c/li\u003e\n\u003cli\u003eArbitrary PHP code injected in the 'Referer' header is executed by the server.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote attackers to execute arbitrary PHP code and system commands on the underlying host, potentially leading to full system compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all internet-facing instances of DedeCMS.\u003c/li\u003e\n\u003cli\u003ePatch affected instances immediately; confirm if the vendor has provided a specific update that remediates the ShowMsg() injection vulnerability.\u003c/li\u003e\n\u003cli\u003eIf a patch is unavailable, restrict access to '/plus/flink.php' at the web application firewall or reverse proxy level.\u003c/li\u003e\n\u003cli\u003eEnable detailed web server logging to capture 'Referer' headers and audit requests to the 'flink.php' endpoint for anomalous payloads containing PHP tags or shell commands.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-22T12:49:36Z","date_published":"2026-10-22T12:02:02Z","id":"https://feed.craftedsignal.io/briefs/2026-10-dedecms-code-injection/","summary":"DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in the ShowMsg() function, allowing unauthenticated attackers to execute arbitrary system commands via a crafted HTTP Referer header.","title":"DedeCMS: PHP code injection in ShowMsg() (CVE-2021-48016)","url":"https://feed.craftedsignal.io/briefs/2026-10-dedecms-code-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - DedeCMS (\u003c= 5.8.1-Beta)","version":"https://jsonfeed.org/version/1.1"}