A reflected cross‑site scripting flaw allows an unauthenticated attacker to inject arbitrary JavaScript by manipulating the adminDirHand parameter. The vulnerability resides in the request handler of /include/dialog/config.php, where user input is concatenated into a script tag without sanitization. When the attacker supplies a crafted GET request, the server closes the script tag and executes the attacker‑supplied code in the victim’s browser, potentially leading to credential theft or session hijacking.

The vulnerability exists in DedeCMS version 5.6 and 5.7. Any server running these versions, especially those with the exposed dialog/config.php endpoint, is susceptible if no mitigation has been applied.

With a CVSS score of 5.1, the vulnerability is of moderate severity. The exploit requires only an unauthenticated user to click a malicious link, making it easily transmittable via phishing or social engineering. No exploit probability (EPSS) data is available, and the issue is not listed in the CISA KEV catalog, but the nature of XSS remains a persistent threat for sites that engage with the vulnerable endpoint.