Dedecms URL Redirection Vulnerability

A URL redirection vulnerability exists in Dedecms versions through 5.71sp1. The issue arises from a logic error in the web application's source code, which fails to properly validate input GET requests, allowing for unintended URL redirects.

Impact

Exploitation of this vulnerability can lead to open redirect scenarios, where users are sent to potentially malicious sites without their knowledge.

Reproduction

To reproduce this vulnerability, upload the provided proof-of-concept script (poc.py) to a server running an affected version of Dedecms. The script can be configured to target a specific domain by modifying the target.txt file. Once uploaded, the script can be executed to demonstrate the URL redirection flaw. Note that some websites may have verification mechanisms that could require additional headers, such as User-Agent or Referer, to be added to the script.

Remediation

Users are advised to update to Dedecms version 5.7.65 or later, where this vulnerability has been addressed.