Dedecms security vulnerability/include/common. inc. php vulnerability solution

Description:

The target has the global variable overwrite vulnerability.

1. Affected versions: DEDECMS 5.7, 5.6, and 5.5.
2. Vulnerability file/include/common. inc. php
3. The global variable initialization vulnerability of DEDECMS allows you to overwrite any global variable.

Hazards:

1. Hackers can use this vulnerability to redefine database connections.
2. Attackers can exploit this vulnerability to initiate unauthorized operations and directly write webshell backdoors.

Temporary solution:

In/include/common. inc. php
Find the code for registering the variable

The code is as follows:	Copy code
Foreach (Array ('_ get',' _ post', '_ COOKIE') as $ _ request) { Foreach ($ _ request as $ _ k = >$ _ v) $ {$ _ k} = _ RunMagicQuotes ($ _ v ); }

Change

The code is as follows:	Copy code
Foreach (Array ('_ get',' _ post', '_ COOKIE') as $ _ request) { Foreach ($ _ request as $ _ k => $ _ v ){ If (strlen ($ _ k)> 0 & eregi ('^ (cfg _ | GLOBALS)', $ _ k )){ Exit ('request var not allow! ');                    } $ {$ _ K} = _ RunMagicQuotes ($ _ v );     } }