CVE-2010-20125 Details

A file inclusion vulnerability has been identified in DedeCMS versions prior to 5.7, specifically in the 'plus/carbuyaction.php' file. This vulnerability allows remote, unauthenticated attackers to manipulate the include path by exploiting the uninitialized 'code' parameter passed to 'require_once'. Attackers can use path traversal sequences to include arbitrary local files outside the designated payment directory, potentially leading to local file disclosure. The vulnerability arises because the 'code' variable is not properly initialized before being used in an include statement, allowing for unauthorized file access.

Users are advised to update to DedeCMS version 5.7 or later, where this vulnerability has been patched.