Vulnerability in Dedecms
CVE-2010-20125
DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating the uninitialized code parameter passed to require_once. Attackers can supply path traversal sequences ../../ to include arbitrary local files outside the intended payment directory, potentially achieving local file disclosure. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- www.cnblogs.com/milantgh/p/3615986.html (technical-description, exploit)
- web.archive.org/web/20100630011301/https://www.myhack58.com/Article/html/3/62/2… (technical-description, exploit)
- github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/ded… (technical-description)
- github.com/dedecms/DedeCMS/releases/tag/v5.7 (patch)
- github.com/dedecms/DedeCMS/blob/v5.6/plus/carbuyaction.php (technical-description)
- www.vulncheck.com/advisories/dedecms-file-inclusion-via-plus-carbuyaction-php (third-party-advisory)
Frequently asked questions
- What is CVE-2010-20125?
- CVE-2010-20125 is a high-severity vulnerability in Dedecms, classified under PHP Remote File Inclusion. CVSS score: 7.5/10. Published 2026-10-30.
- How severe is CVE-2010-20125?
- High severity. CVSS v3 base score is 7.5 out of 10.