An unauthenticated information disclosure vulnerability in DedeCMS version 5.7.118 poses a significant risk to data confidentiality, as it allows remote attackers to access sensitive system information.

This vulnerability is an information disclosure flaw located in the file_manage_control.php component. An unauthenticated remote attacker can exploit the str parameter to retrieve sensitive information from the application.

Successful exploitation of this vulnerability allows unauthorized access to sensitive data, which could lead to further compromise of the application or underlying infrastructure. With a CVSS score of 7.5, this high-severity flaw requires immediate attention to prevent potential data breaches and maintain the integrity of organizational information.

Immediate Action: Since a specific vendor patch is not confirmed, administrators should restrict network access to the file_manage_control.php endpoint and monitor the application for unauthorized requests targeting this file.

Proactive Monitoring: Review web server access logs for anomalous requests containing suspicious strings within the str parameter of the file_manage_control.php file.

Compensating Controls: Deploy Web Application Firewall (WAF) rules to filter or block requests that attempt to pass malicious input to the file_manage_control.php component.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the research reference provided in the CVE record.

Given the high CVSS score and the presence of a public proof-of-concept, this vulnerability represents a significant risk to environments running DedeCMS 5.7.118. Organizations should prioritize isolating the affected component and implementing robust WAF filtering to mitigate potential exploitation until an official security update is provided by the vendor.