DedeCMS Remote Code Execution Vulnerability

A remote code execution vulnerability exists in DedeCMS versions through 5.7.118. The issue arises in the backend module management system, which allows the upload of custom module XML files. During the installation process, the `<setup>` node is base64-decoded and executed via the `include()` function, leading to arbitrary code execution.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server.

Reproduction

To reproduce this vulnerability, log into the DedeCMS backend and navigate to the module management section. Upload a custom module XML file, ensuring to include base64-encoded PHP code in the `<setup>` node. After the module is uploaded, confirm its recognition in the system, then initiate the setup process. Once the setup is completed, the injected PHP code will be executed, allowing for remote code execution.