CVE-2023-3578

MEDIUMNuclei

DedeCMS co_do.php server-side request forgery

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2023-3578 has a selected CVSS score of 5.5 (medium); EIP currently links 1 Nuclei template.

Description

A vulnerability classified as critical was found in DedeCMS 5.7.109. Affected by this vulnerability is an unknown functionality of the file co_do.php. The manipulation of the argument rssurl leads to server-side request forgery. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-233371.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

DedeCMS

CVE List5.7.109affected

Nuclei templates

1
ProjectDiscoveryCRITICALDedeCMS 5.7.109 - Server-Side Request ForgeryCVSS 9.8

Manipulation of the rssurl parameter in co_do.php leads to server-side request forgery in DedeCMS version 5.7.109.

Impact

Successful exploitation could lead to sensitive data exposure, server-side request forgery, and potential server compromise.

Remediation

Apply the vendor-supplied patch or update to a non-vulnerable version of DedeCMS.

WeaknessesCWE-918
Authorsritikchaddha
Template tagscvecve2023dedecmsssrfoastvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:dedecms:dedecms:5.7.109:*:*:*:*:*:*:*
Shodan: http.html:"DedeCms"
FOFA: app="DedeCMS"
https://github.com/nightcloudos/cve/blob/main/SSRF.md https://nvd.nist.gov/vuln/detail/CVE-2023-3578

Source: ProjectDiscovery

References

4