CVE-2017-17731

This vulnerability is like a “badly locked door” in your website’s DedeCMS code. Attackers can use information from an upload request to trick the software into running unwanted database commands. If they do, they may be able to view or change your site’s data, and sometimes disrupt the site.

This matters if you run or host a website using DedeCMS version 5.7 or earlier. The risk is mainly from someone reaching the vulnerable page/feature from the internet, then sending a specially crafted upload-related request. Because the page is publicly reachable in typical setups, you should assume exposure if plus/recommend.php is accessible without additional protections.

Treat this as AMBER because a public exploit is available and attackers can use it to inject SQL through upload-related input. While there is no confirmed KEV listing from the provided findings, the availability of weaponized code and rising attention mean you should mitigate quickly, especially if your site is internet-accessible and uses plus/recommend.php.

1. Confirm exposure

   • Determine whether your web application is running DedeCMS and identify the exact version (specifically check whether it is “through 5.7”).
   • Confirm whether plus/recommend.php is accessible from the public internet (try accessing the page URL in a browser, and/or check web server routing rules).

2. Confirm vulnerable behavior (if feasible)

   • Review whether the recommend feature accepts uploads or relies on PHP’s $_FILES (common when a “recommend” or upload flow exists).
   • If you have application logs or WAF logs, look for requests to plus/recommend.php that include file-upload patterns (multipart requests) or unusual parameters.

3. Remediate (target fixed code)

   • The provided findings state: no fix/patch information is available. That means you likely cannot rely on a straightforward “upgrade to version X” based on these findings alone.
   • Use your internal vendor or DedeCMS community guidance to identify the safest upgrade path off “through 5.7” (e.g., move to a supported release line). If the vendor/community provides a specific fixed version, upgrade to that version.

4. Compensating controls if you cannot upgrade immediately

   • Restrict access to plus/recommend.php:
     • Block it at the web server/WAF for public traffic if the page/function is not required for public users.
     • Alternatively, allow it only from trusted IP ranges or behind authentication, where feasible.
   • Reduce upload risk:
     • If uploads are required, ensure only authenticated users can reach the upload functionality.
     • Place strict server-side validation around uploaded content in the application layer (and consider limiting file types/sizes).

5. Verification after mitigation

   • Re-check that plus/recommend.php is no longer publicly reachable (or requires authentication) and that requests can no longer reach the vulnerable code path.
   • Monitor application and web server logs for continued access attempts to plus/recommend.php.

6. Monitoring

   • Keep an eye on new exploit attempts targeting SQL injection and upload endpoints.
   • Because press attention is rising and a public exploit exists, continue active monitoring until you have definitively upgraded or blocked the vulnerable path.

CISA due date: not provided in the findings (and KEV is not listed).

Severity/impact: The reported scoring indicates very high risk (CVSS 9.8). The weakness is CWE-89 (SQL Injection), which can lead to confidentiality, integrity, and availability impacts via database manipulation.

Mechanism: The vulnerable input is the PHP $_FILES superglobal, reaching plus/recommend.php and allowing an attacker to submit crafted upload-related requests that inject SQL into backend queries.

Exploitation status: Weaponized exploitation is evidenced by a public exploit being available (1 known). KEV (CISA) is not listed in the provided findings.

Attack vector and prerequisites: Network-based (attack over the internet) with low attacker effort and no user interaction required per the CVSS description. No additional precondition (like already having credentials) is stated in the findings beyond reachability of the vulnerable endpoint.

EPSS: A prediction exists (trend: falling), but it should not be treated as a guarantee; exploitation evidence is stronger given the public exploit.

Exploit maturity: At least “public exploit available,” indicating practical attack feasibility.