Vulnerability Description
DedeCMS 5.6 and 5.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input to the adminDirHand parameter. Attackers can send crafted GET requests to /include/dialog/config.php that close the generated script tag and inject JavaScript, which executes in the victim's browser. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-23.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilit
- https://www.cnblogs.com/milantgh/p/3615853.html
- https://www.dedecms.com/
- https://www.vulncheck.com/advisories/dedecms-5.6-5.7-reflected-xss-via-admindirh
FAQ
What is CVE-2014-125131?
CVE-2014-125131 is a vulnerability with a CVSS score of 6.1 (MEDIUM). DedeCMS 5.6 and 5.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input to the adminDirHand parameter. Attacke...
How severe is CVE-2014-125131?
CVE-2014-125131 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-125131?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.