CVE-2021-48016

Summary

In DedeCMS through 5.8.1-beta, the ShowMsg() function improperly includes user-controlled HTTP Referer header content in a template string, enabling unauthenticated remote code execution via crafted requests to /plus/flink.php.

Exploitability

Exploitation is straightforward for unauthenticated attackers due to lack of authentication, input validation, or output encoding on the vulnerable endpoint.

Blast radius

Successful exploitation allows full system compromise including data theft, backdoor installation, and lateral movement within the network.

Detection

Look for HTTP requests to /plus/flink.php with dopost=save and an unusual or executable-looking Referer header in web server access logs; also monitor for unexpected PHP process spawning or suspicious file creation in the web root.

Prioritized remediation

Upgrade to DedeCMS version 5.8.2 or later, which patches this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.