HIGH 8.7 NVD
CVE-2010-20125
DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by
DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating the uninitialized code parameter passed to require_once. Attackers can supply path traversal sequences ../../ to include arbitrary local files outside the intended payment directory, potentially achieving local file disclosure. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
References
- https://github.com/dedecms/DedeCMS/blob/v5.6/plus/carbuyaction.php
- https://github.com/dedecms/DedeCMS/releases/tag/v5.7
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/dedecm
- https://web.archive.org/web/20100630011301/https://www.myhack58.com/Article/html/3/62/2010
- https://www.cnblogs.com/milantgh/p/3615986.html
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-10-30 via NVD.
vulnfeed aggregates 17712 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.