{"id":"CVE-2021-48016","published":"2026-10-22T11:17:04.690","lastModified":"2026-10-22T17:40:46.877","description":"DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to /plus/flink.php?dopost=save with an empty validate code to execute arbitrary PHP and system commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://github.com/dedecms/DedeCMS/blob/v5.8.1/include/common.func.php","tags":[]},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/dedecms/dedecms-rce.yaml","tags":[]},{"url":"https://srcincite.io/blog/2021/09/30/chasing-a-dream-pwning-the-biggest-cms-in-china.html","tags":[]},{"url":"https://www.vulncheck.com/advisories/dedecms-5.8.1-beta-unauthenticated-rce-via-plus-flink-php","tags":[]}],"exploitRefs":[{"url":"https://github.com/dedecms/DedeCMS/blob/v5.8.1/include/common.func.php","tags":[]},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/dedecms/dedecms-rce.yaml","tags":[]}],"hasPoc":true,"ai":{"summary":"In DedeCMS through 5.8.1-beta, the ShowMsg() function improperly includes user-controlled HTTP Referer header content in a template string, enabling unauthenticated remote code execution via crafted requests to /plus/flink.php.","exploitability":"Exploitation is straightforward for unauthenticated attackers due to lack of authentication, input validation, or output encoding on the vulnerable endpoint.","blast_radius":"Successful exploitation allows full system compromise including data theft, backdoor installation, and lateral movement within the network.","remediation":"Upgrade to DedeCMS version 5.8.2 or later, which patches this vulnerability.","detection":"Look for HTTP requests to /plus/flink.php with dopost=save and an unusual or executable-looking Referer header in web server access logs; also monitor for unexpected PHP process spawning or suspicious file creation in the web root.","tags":["rce","php-injection","webapp","unauthenticated","template-injection"],"model":"garnet-coder","analyzedAt":"2026-10-24T08:57:10.279Z"}}