CVE-2024-9076

DedeCMS up to and including version 5.7.115 is vulnerable to OS command injection (CWE-77/CWE-78) in /dede/article_string_mix.php, where unvalidated input is passed to the operating system. The flaw is exploitable remotely, but per the CVSS 4.0 vector it requires high privileges, meaning an attacker must already hold authenticated, likely administrative, access to the CMS backend. Successful exploitation lets the attacker run arbitrary operating system commands on the web server with the privileges of the web application, though the CVSS 4.0 score of 5.1 (medium) indicates limited scope and low-severity impact on confidentiality, integrity, and availability. All DedeCMS deployments running 5.7.115 or earlier are affected, and a public proof-of-concept has been published on Gitee. The vendor was notified but did not respond, no fixed version is stated in the available data, and while the flaw is not yet in CISA KEV, EPSS assigns it a 20.8% probability of exploitation within 30 days (97th percentile).

What to do: Because no fixed version is specified in the available data and the vendor has not responded, restrict and monitor access to /dede/article_string_mix.php, limiting it to trusted administrative users only. Check web logs for unexpected requests or command metacharacters targeting that endpoint, and apply a WAF rule blocking shell metacharacters in parameters to that script as an interim mitigation. Watch the vendor's distribution channels for a patched release and upgrade beyond 5.7.115 as soon as a fix becomes available.