CVE-2026-116253

DedeCMS Advertisement Rendering ad_js.php _RunMagicQuotes code injection

View on CVE.org
Published Oct 26, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was determined in DedeCMS 5.7.118. This vulnerability affects the function common.inc.php::_RunMagicQuotes of the file plus/ad_js.php of the component Advertisement Rendering. Executing a manipulation of the argument aid can lead to code injection. The attack can be executed remotely.

Analysis

AI-generated

Technical impact

This vulnerability arises from improper handling of the "aid" argument in the Advertisement Rendering component of DedeCMS. The common.inc.php::_RunMagicQuotes function fails to sanitize the input before it is used to evaluate PHP code in ad_js.php, allowing an attacker to inject arbitrary code. If exploited, an attacker can execute PHP on the server, leading to full compromise of the web application and potentially the underlying operating system.

Affected Systems

The affected vendor is DedeCMS, specifically version 5.7.118. The flaw resides in the plus/ad_js.php file and the common.inc.php::_RunMagicQuotes function. Systems running this exact version are potentially vulnerable; other versions are not reported to contain this issue.

Risk and Exploitability

The vulnerability has a CVSS score of 6.9, indicating moderate severity. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack can be performed remotely without authentication by sending a crafted HTTP request that manipulates the aid parameter. Because it enables arbitrary PHP code execution, the risk to confidentiality, integrity, and availability is significant and warrants immediate attention.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor patch or upgrade to a later DedeCMS version that fixes the _RunMagicQuotes bug in ad_js.php.
  • If a patch is not available, disable or remove the Advertisement Rendering component or restrict access to the plus/ad_js.php endpoint.
  • Implement input validation for the aid parameter, ensuring it contains only permitted values and rejecting non‑numeric or excessively long input.

Generated by OpenCVE AI on October 26, 2026 at 10:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was determined in DedeCMS 5.7.118. This vulnerability affects the function common.inc.php::_RunMagicQuotes of the file plus/ad_js.php of the component Advertisement Rendering. Executing a manipulation of the argument aid can lead to code injection. The attack can be executed remotely.
Title DedeCMS Advertisement Rendering ad_js.php _RunMagicQuotes code injection
First Time appeared Dedecms
Dedecms dedecms
Weaknesses CWE-74
CWE-94
CPEs cpe:2.3:a:dedecms:dedecms:*:*:*:*:*:*:*:*
Vendors & Products Dedecms
Dedecms dedecms
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 26, 2026, 4:31 PM
Reserved
Oct 25, 2026, 4:30 PM

View source JSON

Updated
Oct 26, 2026, 3:42 PM

JSON

Status
Deferred
Published
Oct 26, 2026, 10:16 AM
Modified
Oct 26, 2026, 5:17 PM

View source JSON

No data.

Updated
Oct 26, 2026, 10:45 AM

JSON