CVE-2018-7700: DedeCMS tag_test_action.php CSRF leads to arbitrary PHP code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCVSS 8.8 with network reachability, no attacker authentication, and public exploit references, though exploitation requires victim interaction and no KEV listing exists.

What it is

DedeCMS 5.7 allows a cross-site request forgery in tag_test_action.php where the partcode parameter can specify a runphp field containing PHP code. Because the injected PHP is executed, a forged request can turn a victim's session into remote code execution on the server. The flaw is rated CVSS 3.0 8.8 (HIGH) with a network vector and required user interaction.

Impact

An attacker who lures an authenticated victim into a crafted request can execute arbitrary PHP code on the DedeCMS server, gaining the web server's privileges and potentially full control of the site and its data.

Attack surface

Reached over the network via a crafted request to tag_test_action.php; no prior authentication is required by the attacker, but the victim must be authenticated and must trigger the forged request (UI:R).

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.74118, 99.46th percentile) and both references are tagged Exploit, indicating public exploit material exists. No ransomware association is documented.

What to do

• Upgrade DedeCMS to a version later than 5.7 that fixes the tag_test_action.php CSRF and runphp handling; if no fixed release is available, restrict or remove access to tag_test_action.php.
• Add CSRF tokens to state-changing administrative requests and reject requests lacking a valid token.
• Disable or strictly validate the runphp field and partcode parameter so user-supplied PHP is never evaluated.
• Restrict administrative interfaces to trusted networks or VPN and require re-authentication for sensitive actions.
• Deploy a WAF rule blocking runphp or PHP code patterns in tag_test_action.php requests as a temporary control.

Detection

• Monitor web logs for POST or GET requests to tag_test_action.php containing partcode or runphp parameters.
• Alert on PHP code patterns (for example eval, system, exec, base64_decode) in request parameters to DedeCMS endpoints.
• Correlate administrative session activity with unexpected outbound connections or new files written under the web root.
• Review DedeCMS file integrity and PHP error logs for unexpected code execution following tag_test_action.php requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.