Description

A vulnerability was found in DedeCMS up to 5.7.118. The affected element is an unknown function of the file plus/mytag_js.php. The manipulation of the argument aid results in code injection. The attack can be launched remotely. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-20T12:17:05.593Z",
  "pubdate": "2026-09-20T12:17:05.593Z",
  "executiveSummary": "DedeCMS versions up to 5.7.118 are susceptible to a critical remote code injection vulnerability. This flaw resides within the plus/mytag_js.php file, specifically involving the improper handling of user-supplied input through the aid argument.\nThe vulnerability allows unauthenticated remote attackers to execute arbitrary PHP code on the underlying server. Successful exploitation leads to full system compromise, granting the attacker the ability to read, modify, or delete sensitive data, install backdoors, or pivot further into the internal network infrastructure.\nGiven that proof-of-concept exploit code is publicly available, the risk of exploitation is high. Organizations utilizing affected versions of DedeCMS are at significant risk of unauthorized access and data exfiltration. No specialized authentication or high-level privileges are required to initiate the attack, making this a high-priority security issue that requires immediate remediation or the implementation of strict network-level ingress filtering.",
  "technicalDetails": "The vulnerability is a classic case of improper input validation within the web application's dynamic processing logic. The specific component affected is plus/mytag_js.php, which serves to generate dynamic JavaScript content based on parameters passed via URL arguments. The root cause lies in the application's failure to sanitize or validate the aid argument before utilizing it in database queries or subsequent execution logic.\nThe attack flow proceeds as follows: An attacker sends a crafted HTTP GET or POST request to the target server pointing to plus/mytag_js.php. By injecting malicious payloads into the aid parameter, the attacker can manipulate the internal query execution flow. Because the application processes this input without sufficient sandboxing or encoding, the malicious input can be interpreted as executable code or used to facilitate SQL injection, which subsequently leads to Remote Code Execution (RCE).\nIn the context of this vulnerability, the aid argument acts as an entry point for user-controlled input that interacts with the server's backend processing. When the vulnerable function processes this parameter, it fails to perform effective character escaping or type casting. Consequently, an attacker can append PHP syntax or database-query-modifying statements to the aid argument. If the system architecture allows the evaluation of these strings, the server effectively executes the attacker's payload within the context of the web server process (e.g., www-data).\nThis vulnerability is reachable over the network without requiring any prior authentication, as the plus/mytag_js.php script is designed to be publicly accessible to generate scripts for client-side inclusion. Once the code execution is achieved, the post-exploitation impact includes the total loss of confidentiality, integrity, and availability of the affected system. Attackers typically use this access to establish a web shell, which provides persistent remote access to the file system, enabling the execution of system-level commands, scanning of internal network segments, or the deployment of ransomware or cryptominers.\nThe exposure is exacerbated by the fact that the exploit mechanism has been publicly disseminated, lowering the barrier to entry for even low-skilled threat actors. The vulnerability affects all versions of DedeCMS up to 5.7.118."
}