CVE-2014-125131

Received Received - Intake

Reflected XSS in DedeCMS via adminDirHand Parameter

Publication date: 2026-10-20

Last updated on: 2026-10-21

Assigner: VulnCheck

Description

DedeCMS 5.6 and 5.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input to the adminDirHand parameter. Attackers can send crafted GET requests to /include/dialog/config.php that close the generated script tag and inject JavaScript, which executes in the victim's browser. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-23.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-21

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2014-125131

Affected Vendors & Products

Vendor	Product	Version / Range
DedeCMS	DedeCMS	5.6
DedeCMS	DedeCMS	5.7

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

DedeCMS 5.6 and 5.7 has a reflected cross-site scripting (XSS) vulnerability. Unauthenticated attackers can inject malicious scripts by sending crafted GET requests to /include/dialog/config.php with unsanitized input via the adminDirHand parameter. This allows attackers to close script tags and inject JavaScript that executes in a victim's browser.

Detection Guidance

To detect this vulnerability, monitor HTTP GET requests to /include/dialog/config.php with unsanitized adminDirHand parameter input. Look for crafted requests attempting to inject JavaScript via script tag closure.

Impact Analysis

This vulnerability allows attackers to execute arbitrary JavaScript in the context of a victim's browser session. This could lead to theft of session cookies, account takeover, or delivery of malware. Users of vulnerable DedeCMS instances may have their data compromised without any authentication required from the attacker.

Compliance Impact

This XSS vulnerability could lead to unauthorized access to sensitive user data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations may face compliance violations, fines, or legal consequences if user data is compromised due to this flaw.

Mitigation Strategies

Immediately update DedeCMS to the latest patched version. If an update is unavailable, restrict access to /include/dialog/config.php via server configuration and sanitize all user inputs to prevent XSS attacks.

Hi! I’m here to help you understand CVE-2014-125131. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...