CVE-2023-2928

What it actually does

CVE-2023-2928 is a remote code injection vulnerability in DedeCMS versions up to 5.7.106. The vulnerable component is uploads/dede/article_allowurl_edit.php, where insufficient validation or sanitization of the allurls argument can allow an authenticated attacker to inject executable code or malicious PHP content through a web-accessible administrative function. Because the vulnerability is network-accessible, low-complexity, and requires only low privileges, successful exploitation can lead to full compromise of confidentiality, integrity, and availability of the affected DedeCMS application and potentially the underlying web server account.

Why it matters to the business

An attacker with valid low-privileged access to a vulnerable DedeCMS instance could take control of the website, alter published content, steal sensitive data, deploy web shells, redirect visitors, or use the server for further attacks. The public disclosure of exploit details and a high EPSS score indicate meaningful exploitation likelihood, especially for internet-facing DedeCMS deployments that have remained unpatched for a long period since publication. Organizations relying on DedeCMS for public websites may face defacement, data exposure, malware hosting, reputational harm, and operational downtime.

How an attack unfolds

An attacker first identifies a DedeCMS site exposing the vulnerable administrative upload path or confirms the application version is at or below 5.7.106. Because exploitation requires privileges, the attacker typically obtains or abuses a low-privileged DedeCMS account through credential theft, password reuse, phishing, brute force, or another application weakness. After authentication, the attacker sends a crafted request to uploads/dede/article_allowurl_edit.php with malicious content in the allurls parameter. If the application processes the value unsafely, attacker-controlled code is injected into the application context. The attacker can then execute commands or plant a persistent PHP web shell, use the compromised site to modify content or steal data, and attempt lateral movement depending on the web server permissions and hosting configuration.

How to fix it

Upgrade DedeCMS to a vendor-supported release that addresses this vulnerability if available. Because no fixed version was provided in the input, organizations should obtain the latest official DedeCMS release or vendor patch and verify whether the vulnerable uploads/dede/article_allowurl_edit.php handling of the allurls parameter has been corrected. If immediate patching is not possible, restrict access to the DedeCMS administrative interface by IP allowlisting, VPN, or strong access controls; disable or remove the vulnerable article_allowurl_edit.php functionality if it is not required; enforce multi-factor authentication where supported; rotate DedeCMS administrator and editor credentials; and apply web application firewall rules that block suspicious requests to article_allowurl_edit.php containing code-like payloads in allurls. Harden the host by ensuring the web server user has minimal filesystem privileges and cannot write executable files outside required upload/cache directories.

How to confirm the fix worked

Confirm that the DedeCMS installation is no longer version 5.7.106 or earlier and that the deployed code contains a corrected implementation for uploads/dede/article_allowurl_edit.php. Review whether article_allowurl_edit.php remains reachable from untrusted networks and verify that only authorized administrative users can access it. Test that requests containing code-like content in the allurls parameter are rejected, sanitized, or safely encoded rather than stored or executed. Validate web server permissions by confirming that uploaded or application-written files cannot be executed as PHP in upload directories unless explicitly required. Review WAF, access-control, and authentication changes to ensure direct requests to the vulnerable path are blocked from unauthorized sources.

Typical attack path

1. Identify an internet-facing DedeCMS deployment and determine whether it is running version 5.7.106 or earlier.
2. Acquire valid low-privileged DedeCMS credentials or access to an authenticated session.
3. Send a crafted HTTP request to uploads/dede/article_allowurl_edit.php containing malicious payload content in the allurls parameter.
4. Trigger vulnerable processing of the allurls value to inject code into the application context.
5. Use the resulting execution capability to create a PHP web shell, modify site files, exfiltrate data, or run commands under the web server account.
6. Establish persistence, clean logs where possible, and use the compromised website for defacement, credential theft, malware hosting, or further intrusion.

How to detect it

To determine whether this vulnerability was already exploited, review HTTP access logs, reverse proxy logs, WAF logs, and DedeCMS administrative/application logs for requests to uploads/dede/article_allowurl_edit.php, especially POST requests or requests containing the allurls parameter with code-like content. Focus on activity from unusual IP addresses, unexpected authenticated users, atypical user agents, requests outside normal administrative hours, repeated errors followed by successful requests, and payloads containing PHP tags, command execution functions, encoded data, shell metacharacters, or file-write patterns. Correlate suspicious requests with filesystem changes in the DedeCMS web root, upload directories, template directories, cache directories, and any writable PHP directories. Look for newly created or recently modified .php files, obfuscated PHP, web shells, unexpected admin account changes, modified configuration files, and outbound connections from the web server process after suspicious requests. Host-level telemetry should be reviewed for web server child processes launching shell interpreters or system utilities such as sh, bash, cmd, powershell, curl, wget, nc, perl, python, or php with unusual arguments.

• /uploads/dede/article_allowurl_edit.php
• article_allowurl_edit.php
• allurls=
• allurls%5B
• <?php
• %3C%3Fphp
• eval(
• assert(
• system(
• exec(
• shell_exec(
• passthru(
• base64_decode(
• gzinflate(
• str_rot13(
• preg_replace
• /e
• file_put_contents(
• fwrite(
• chmod(
• move_uploaded_file(
• cmd=
• pass=
• /bin/sh
• /bin/bash
• wget
• curl
• nc
• /uploads/
• /dede/
• *.php in upload directories

What your security team should do

• Prioritize remediation for any internet-facing DedeCMS instance running version 5.7.106 or earlier due to public disclosure, low attack complexity, and elevated EPSS likelihood.
• Inventory all DedeCMS deployments, including legacy marketing sites, microsites, and third-party-hosted installations.
• Upgrade to the latest official DedeCMS release or apply the vendor patch that corrects allurls handling in uploads/dede/article_allowurl_edit.php.
• Restrict DedeCMS administrative paths to trusted networks or VPN users only, and remove public exposure where feasible.
• Rotate DedeCMS credentials and investigate weak, shared, reused, or dormant accounts that could satisfy the low-privilege requirement.
• Hunt for exploitation attempts against uploads/dede/article_allowurl_edit.php and for suspicious allurls parameter values in web access logs, WAF logs, and application logs.
• Search web roots and upload directories for newly created PHP files, obfuscated PHP code, web shells, and unexpected modifications after the vulnerability disclosure date.
• Add WAF/SIEM detections for requests to article_allowurl_edit.php containing PHP tags, command-execution functions, encoded payloads, or unusual metacharacters.
• Harden file permissions so the web server process cannot modify application code or execute files from upload directories.
• If compromise is suspected, preserve logs and filesystem timestamps, isolate the host, remove malicious files, rebuild from known-good media where necessary, and rotate all secrets accessible to the application.