CVE-2025-5137: Dedecms 5.7.117 RCE Vulnerability

CVE-2025-5137 Overview

CVE-2025-5137 is a code injection vulnerability in DedeCMS 5.7.117, a PHP-based content management system. The flaw resides in the dede/sys_verifies.php?action=getfiles endpoint, where the refiles argument is processed without sufficient validation. This issue represents an incomplete fix for the earlier CVE-2018-9175, allowing authenticated attackers to inject code remotely. Public disclosure of the exploit technique has occurred, increasing the risk of opportunistic abuse against unpatched installations.

Critical Impact

Authenticated remote attackers can inject and execute code through the refiles parameter, leading to confidentiality, integrity, and availability impacts on the underlying web application.

Affected Products

• DedeCMS 5.7.117
• Component: dede/sys_verifies.php (action getfiles)
• Incomplete fix for CVE-2018-9175

Discovery Timeline

• 2025-05-25 - CVE-2025-5137 published to the National Vulnerability Database (NVD)
• 2025-06-10 - Last updated in NVD database

Technical Details for CVE-2025-5137

Vulnerability Analysis

The vulnerability is classified under [CWE-94] Improper Control of Generation of Code and [CWE-74] Improper Neutralization of Special Elements in Output. It affects the verification subsystem of DedeCMS, specifically the getfiles action handler in sys_verifies.php. The handler accepts a refiles parameter that is incorporated into runtime processing without complete neutralization of code-bearing input.

Because the prior remediation for CVE-2018-9175 did not fully sanitize all execution paths, attackers can craft refiles values that introduce attacker-controlled code into the application logic. The exploit has been publicly disclosed, and exploitation requires network access to the administrative interface.

Root Cause

The root cause is insufficient input sanitization in the getfiles action of sys_verifies.php. The patch applied for CVE-2018-9175 left residual paths through which the refiles argument can influence code generation or inclusion. Attacker-supplied content reaches sinks that interpret data as code, enabling injection.

Attack Vector

The attack is delivered over the network against the DedeCMS administrative endpoint. The CVSS vector indicates high privileges are required, meaning the attacker must hold an authenticated session with access to the verification function. No user interaction is needed, and the attack complexity is low. Successful injection produces low-level impacts on confidentiality, integrity, and availability within the application scope.

No verified public exploit code is available in the enriched data. Technical details are referenced in the public advisory at GitHub Issue #2 (CyberPunk-Infernity Advisory) and tracked under VulDB #310218.

Detection Methods for CVE-2025-5137

Indicators of Compromise

• HTTP requests to dede/sys_verifies.php containing the parameter action=getfiles combined with unexpected payloads in the refiles argument.
• Creation or modification of PHP files in DedeCMS directories shortly after requests to sys_verifies.php.
• Unexpected outbound connections initiated by the PHP worker process serving DedeCMS.

Detection Strategies

• Inspect web server access logs for POST or GET requests targeting sys_verifies.php?action=getfiles with refiles values containing path separators, PHP tokens, or backticks.
• Deploy web application firewall (WAF) rules that flag code-injection patterns against the verification endpoint.
• Hash and monitor core DedeCMS files to detect unauthorized writes following administrative activity.

Monitoring Recommendations

• Alert on authenticated administrator sessions originating from unusual IP ranges or geographies.
• Capture and review PHP error logs for suspicious include, require, or eval activity tied to the verification flow.
• Forward web server, PHP, and host telemetry to a centralized analytics platform for correlation across sessions.

How to Mitigate CVE-2025-5137

Immediate Actions Required

• Restrict network access to the /dede/ administrative directory to trusted IP addresses only.
• Audit administrator accounts and rotate credentials, removing unused or stale accounts that could be abused to meet the high-privilege exploitation prerequisite.
• Review web server logs for prior requests to sys_verifies.php?action=getfiles and investigate any matches.

Patch Information

At the time of NVD publication, no vendor advisory URLs are listed in the enriched data. Operators of DedeCMS 5.7.117 should monitor the DedeCMS project channels and VulDB entry 310218 for updated patch information and apply fixes as soon as they become available.

Workarounds

• Disable or remove the sys_verifies.php file if the version verification feature is not required in production.
• Place the /dede/ administrative path behind an authenticated reverse proxy or VPN to reduce exposure.
• Add WAF rules to block requests where the refiles parameter contains characters or sequences associated with code injection.

# Example nginx restriction limiting /dede/ to trusted networks
location ^~ /dede/ {
    allow 10.0.0.0/8;
    deny all;
    try_files $uri $uri/ /index.php?$args;
}