Live › vulnerability › CVE-2010-20125
DedeCMS before 5.7 lets a remote, unauthenticated visitor control the path passed to require_once in plus/carbuyaction.php through the code parameter. Using ../../ sequences, an attacker can include and read arbitrary local files outside the payment directory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 15:31 UTC. All times on this page are UTC.
Sites running DedeCMS older than 5.7 that expose the payment cart endpoint plus/carbuyaction.php to the internet. Sites on 5.7 or later, or with that file removed or blocked, are not affected according to the sources.
No product ranges from the sources yet.
plus/carbuyaction.php in the DedeCMS install directory5.7 or later (sources state versions before 5.7 are affected)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating the uninitialized code parameter passed to require_once. Attackers can supply path traversal sequences ../../ to include arbitrary local files outside the intended payment directory, potentially achieving local file disclosure. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
This page as .md · .json · in your agent: get_signal("CVE-2010-20125")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.