CVE-2018-6910 — AI Deep Analysis Summary

🚨 **Essence**: DedeCMS 5.7 suffers from an **Information Disclosure** vulnerability. 📉 **Consequences**: Attackers can retrieve the **full server file path** via direct requests to specific PHP files.

🛡️ **Root Cause**: The flaw lies in **improper error handling** or path exposure in `include/downmix.inc.php` and `inc/inc_archives_functions.php`.…

🎯 **Affected**: **Desdev DedeCMS** (Zhimeng CMS). 📦 **Version**: Specifically **Version 5.7**. 🌐 **Component**: The PHP CMS engine itself.

🕵️ **Hackers Can**: Send direct HTTP requests to trigger errors. 💾 **Data Leaked**: **Full absolute file paths** on the server. 🚫 **Note**: Data is limited to paths, not direct RCE or DB dump in this specific vector.

🔓 **Threshold**: **LOW**. 🚫 **Auth Required**: **None**. 🌍 **Remote**: Yes, any remote attacker can exploit this without login credentials.

💥 **Public Exp?**: **YES**. 📜 **PoC**: Available via **Nuclei templates** (projectdiscovery) and GitHub repositories (kongxin520). 🔄 **Wild Exploitation**: High potential due to simplicity.

🔍 **Self-Check**: Scan for direct requests to: 1. `/include/downmix.inc.php` 2. `/inc/inc_archives_functions.php`. 👀 **Indicator**: Look for **file path strings** in the HTTP response body.

🩹 **Official Fix**: Data does **not** list a specific official patch version. 📅 **Published**: 2018-02-13. ⚠️ **Status**: Likely requires manual code modification or upgrading to a patched fork if available.

🛡️ **Workaround**: **Block access** to `downmix.inc.php` and `inc_archives_functions.php` via WAF or Web Server config (Nginx/Apache).…

⚡ **Urgency**: **MEDIUM-HIGH**. 📉 **Risk**: While it only leaks paths, this aids **further attacks** (like LFI or RCE). 🏃 **Action**: Patch immediately if running DedeCMS 5.7.