{"id":"CVE-2014-125131","kind":"vulnerability","aliases":["CVE-2014-125131"],"related":[],"title":"DedeCMS: reflected XSS in config.php lets attackers run script in browsers","description":"DedeCMS 5.6 and 5.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input to the adminDirHand parameter. Attackers can send crafted GET requests to /include/dialog/config.php that close the generated script tag and inject JavaScript, which executes in the victim's browser. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-23.","summary":"DedeCMS 5.6 and 5.7 does not sanitize the adminDirHand parameter on /include/dialog/config.php, so a crafted GET link breaks out of a generated script tag. A victim who opens the link runs attacker-supplied JavaScript in their browser.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dedecms","package","php","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Check whether the site runs DedeCMS version `5.6` or `5.7`\n- Request `/include/dialog/config.php` with an `adminDirHand` parameter containing script markup in a test environment only, and see whether it is echoed unescaped","fix":null,"status":"open","published_at":"2026-10-20T21:17:12+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T04:04:02+00:00","updated_at":"2026-10-25T04:04:02+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:04:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"DedeCMS: reflected XSS in config.php lets attackers run script in browsers","impact":"medium","summary":"DedeCMS 5.6 and 5.7 does not sanitize the adminDirHand parameter on /include/dialog/config.php, so a crafted GET link breaks out of a generated script tag. A victim who opens the link runs attacker-supplied JavaScript in their browser.","category":"package","nicknames":[],"who_cares":["dedecms","php","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker script runs in a victim's browser on the site","analyst_note":"Sources do not name a fixed version or patch; check the NVD page and DedeCMS release notes for a fix or workaround.","how_to_check":"- Check whether the site runs DedeCMS version `5.6` or `5.7`\n- Request `/include/dialog/config.php` with an `adminDirHand` parameter containing script markup in a test environment only, and see whether it is echoed unescaped","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Sites running DedeCMS 5.6 or 5.7 that expose the /include/dialog/config.php endpoint. The attack needs a victim to open a crafted link, so administrators who browse the backend are the most exposed. Sites on other versions or with that file removed or blocked can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000605,"input_tokens":3387,"output_tokens":533,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-10':124C '-125131':14A,17A '-2014':13A,16A '-23':125C '/include/dialog/config.php':35B,96C '2023':123C '5.6':25B,63C '5.7':27B,65C 'admindirhand':32B,87C 'allow':75C 'attack':7A,56B,77C,89C 'attacker-suppli':55B 'break':41B 'browser':11A,61B,112C 'close':98C 'config.php':5A 'contain':66C 'craft':38B,92C 'cross':70C 'cross-sit':69C 'cve':12A,15A 'dedecm':1A,18B,24B,62C 'evid':114C 'execut':107C 'exploit':113C 'first':116C 'foundat':121C 'generat':45B,100C 'get':39B,93C 'host':23B 'inject':79C,104C 'input':84C 'javascript':58B,105C 'let':6A 'link':40B,53B 'observ':117C 'open':51B 'packag':19B 'paramet':33B,88C 'php':20B 'reflect':2A,68C 'request':94C 'run':8A,54B 'sanit':30B 'script':9A,46B,72C,80C,101C 'self':22B 'self-host':21B 'send':91C 'shadowserv':120C 'site':71C 'suppli':57B,82C 'tag':47B,102C 'unauthent':76C 'unsanit':83C 'victim':49B,110C 'vulner':73C 'xss':3A","nicknames":[],"mitigations":[],"who_affected":"Sites running DedeCMS 5.6 or 5.7 that expose the /include/dialog/config.php endpoint. The attack needs a victim to open a crafted link, so administrators who browse the backend are the most exposed. Sites on other versions or with that file removed or blocked can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2014-125131","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-125131","severity":null,"published_at":"2026-10-20T21:17:12+00:00","modified_at":"2026-10-22T17:40:46+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}