Cyber Resilience

CVE-2018-7700

CSRF in Dedecms 5.7

Public PoCHigh EPSSCSRF
Published
27 March 2018
Modified
21 November 2024
CVSS Score v3 8.8
Click a component to see what it means
Raw vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.75 99.5th percentile
Risk Priority 87 floored blend · peak EPSS

Summary

CVE-2018-7700 is a high-severity CSRF (CWE-352) vulnerability in Dedecms Dedecms. Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 0.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode parameter in a tag_test_action.php request can specify a runphp field in conjunction with PHP code.

CWE(s)

Related Threats

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
CSRF on a public-facing CMS endpoint allows remote arbitrary PHP code execution without authentication.
T1059.006 Python Executionconfidence: HIGH
The vulnerability permits direct execution of attacker-supplied PHP code via the runphp field.
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2024-28678Same product: Dedecms Dedecms
CVE-2024-2822Same product: Dedecms Dedecms
CVE-2024-2821Same product: Dedecms Dedecms
CVE-2024-28429Same product: Dedecms Dedecms
CVE-2024-28675Same product: Dedecms Dedecms
CVE-2024-28669Same product: Dedecms Dedecms
CVE-2024-30965Same product: Dedecms Dedecms
CVE-2024-4587Same product: Dedecms Dedecms
CVE-2024-28670Same product: Dedecms Dedecms
CVE-2024-3145Same product: Dedecms Dedecms

Affected Assets

dedecms
dedecms
5.7

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V3.3.2
  • V3.5.1
  • V10.2.1

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-352

Awareness training educates users on avoiding untrusted links and actions that can be exploited via CSRF.

addresses: CWE-352

Requiring user re-entry of credentials for sensitive actions prevents automated forgery of requests without active user participation.

addresses: CWE-352

Security testing regimens explicitly include checks for missing or ineffective anti-CSRF protections in web applications.

addresses: CWE-352

Detects anomalous request patterns consistent with cross-site request forgery.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require anti-CSRF controls such as tokens or SameSite attributes.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

mitigates

By denying access to phishing or malicious sites, the control lowers the likelihood that a user will be tricked into submitting a forged request that performs an unintended action on another site.

none

Contextual intelligence about emerging CSRF toolkits can be translated into updated anti-CSRF token or same-site policy configurations across applications.

References