A critical Cross-Site Request Forgery vulnerability in DedeCMS v5.7.118 allows unauthenticated attackers to perform unauthorized actions on behalf of a victim.

The application is susceptible to a Cross-Site Request Forgery (CSRF) attack via the sys_task_add.php endpoint, which does not adequately validate requests initiated by an unauthenticated attacker.

Successful exploitation of this CSRF vulnerability allows an attacker to force an authenticated user to perform unintended actions without their consent. Given the CVSS score of 8.8, the potential for high impact on confidentiality, integrity, and availability is significant, posing a serious risk of unauthorized administrative tasks being executed within the application.

Immediate Action: Review the official DedeCMS security advisories for available patches or configuration changes to secure the sys_task_add.php endpoint.

Proactive Monitoring: Monitor server access logs for anomalous requests directed at administrative files and unusual patterns originating from external sources.

Compensating Controls: Implement anti-CSRF tokens for all state-changing operations and utilize a Web Application Firewall to filter suspicious HTTP requests.

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the linked GitHub Gist reference.

The severity of this vulnerability necessitates immediate attention to prevent unauthorized administrative actions. Organizations should prioritize updating their DedeCMS installation or applying the vendor-provided mitigation steps to eliminate the CSRF risk.