Description
A vulnerability was determined in DedeCMS 5.7.118. This vulnerability affects the function common.inc.php::_RunMagicQuotes of the file plus/ad_js.php of the component Advertisement Rendering. Executing a manipulation of the argument aid can lead to code injection. The attack can be executed remotely.
Published: 2026-10-26
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: Remote Code Execution via code injection in Advertisement Rendering component
Action: Immediate Patch
AI Analysis

Impact

This vulnerability arises from improper handling of the "aid" argument in the Advertisement Rendering component of DedeCMS. The common.inc.php::_RunMagicQuotes function fails to sanitize the input before it is used to evaluate PHP code in ad_js.php, allowing an attacker to inject arbitrary code. If exploited, an attacker can execute PHP on the server, leading to full compromise of the web application and potentially the underlying operating system.

Affected Systems

The affected vendor is DedeCMS, specifically version 5.7.118. The flaw resides in the plus/ad_js.php file and the common.inc.php::_RunMagicQuotes function. Systems running this exact version are potentially vulnerable; other versions are not reported to contain this issue.

Risk and Exploitability

The vulnerability has a CVSS score of 6.9, indicating moderate severity. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack can be performed remotely without authentication by sending a crafted HTTP request that manipulates the aid parameter. Because it enables arbitrary PHP code execution, the risk to confidentiality, integrity, and availability is significant and warrants immediate attention.

Generated by OpenCVE AI on October 26, 2026 at 10:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor patch or upgrade to a later DedeCMS version that fixes the _RunMagicQuotes bug in ad_js.php.
  • If a patch is not available, disable or remove the Advertisement Rendering component or restrict access to the plus/ad_js.php endpoint.
  • Implement input validation for the aid parameter, ensuring it contains only permitted values and rejecting non‑numeric or excessively long input.

Generated by OpenCVE AI on October 26, 2026 at 10:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 09:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in DedeCMS 5.7.118. This vulnerability affects the function common.inc.php::_RunMagicQuotes of the file plus/ad_js.php of the component Advertisement Rendering. Executing a manipulation of the argument aid can lead to code injection. The attack can be executed remotely.
Title DedeCMS Advertisement Rendering ad_js.php _RunMagicQuotes code injection
First Time appeared Dedecms
Dedecms dedecms
Weaknesses CWE-74
CWE-94
CPEs cpe:2.3:a:dedecms:dedecms:*:*:*:*:*:*:*:*
Vendors & Products Dedecms
Dedecms dedecms
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Dedecms Dedecms
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-26T09:30:05.471Z

Reserved: 2026-10-25T16:30:24.403Z

Link: CVE-2026-116253

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-26T10:16:52.693

Modified: 2026-10-26T10:16:52.693

Link: CVE-2026-116253

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T10:30:10Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')