DedeCMS: Unauthenticated PHP code injection via Referer header in flink.php
Summary
DedeCMS through 5.8.1-beta contains a PHP code injection flaw in ShowMsg(), where the HTTP Referer header is written into a template string that is later included. An unauthenticated attacker can send a crafted Referer to /plus/flink.php?dopost=save with an empty validate code and execute arbitrary PHP code and operating system commands on the web server. Shadowserver reported exploitation attempts from 14 October 2023, and a public Nuclei proof-of-concept template exists.
Affected
- DedeCMS through 5.8.1-beta (range reported as 0 to <= 5.8.1-beta; default configuration status unknown)
- Whether the 5.7.x stable line is affected: Unknown.
Fixed in
- Unknown. No vendor advisory or fixed version has been confirmed.
Workaround
- No vendor workaround known.
- Block or restrict direct access to /plus/flink.php at the web server or WAF.
- Take the site offline or restrict access until the risk is assessed.
Exploitation
- Remote, unauthenticated attack over HTTP.
- Exploitation evidence reported by Shadowserver from 14 October 2023; not listed in CISA KEV.
- Public proof-of-concept (Nuclei template) available.
- CISA SSVC: exploitation PoC, automatable yes, technical impact total.
Our recommendation
- Check whether DedeCMS is used on any internet-facing system, including legacy and agency-built sites.
- Remove the CMS or restrict access to it if it is not needed.
- Block /plus/flink.php and review web logs for requests to that path with unusual Referer headers.
- Check the web root for webshells and unexpected PHP files; assume compromise if the path was reachable.
- Upgrade to a supported, vendor-confirmed fixed version only after testing; no fix has been confirmed yet.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- Vulners/NVD record vulners.com
- VulDB vuldb.com
- HOL advisory hol.org
- Strix CVE record www.strix.ai
- Nuclei template github.com
- DedeCMS download page www.dedecms.com
- DedeCMS GitHub releases github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:55.
Original description (NVD)
DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to /plus/flink.php?dopost=save with an empty validate code to execute arbitrary PHP and system commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
NVD references (4)
- https://github.com/dedecms/DedeCMS/blob/v5.8.1/include/common.func.php
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/dedecms/dedecms-rce.yaml
- https://srcincite.io/blog/2021/09/30/chasing-a-dream-pwning-the-biggest-cms-in-china.html
- https://www.vulncheck.com/advisories/dedecms-5.8.1-beta-unauthenticated-rce-via-plus-flink-php
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.