Admin-level code execution via arbitrary PHP file write
Published Dec 14, 2025 · Updated Dec 14, 2025
Code injection in DedeBIZ 6.5.0 through 6.5.9 allows remote authenticated users to execute PHP code through catalog_add.php. The backend catalog module accepts attacker-controlled file content without security validation and writes it into a server-side PHP file that can be requested for execution. Administrative backend privileges are required; successful exploitation runs attacker-supplied PHP in the web server context, enabling control of application data and service behavior.
Summary
What happened
Code injection in DedeBIZ 6.5.0 through 6.5.9 allows remote authenticated users to execute PHP code through catalog_add.php. The backend catalog module accepts attacker-controlled file content without security validation and writes it into a server-side PHP file that can be requested for execution. Administrative backend privileges are required; successful exploitation runs attacker-supplied PHP in the web server context, enabling control of application data and service behavior.
The record
- CVE
- CVE-2025-14648
- Published
- Dec 14, 2025
- Updated
- Dec 14, 2025
- Vendor
- Shanghai Muyun Intelligent Technology Co., Ltd.
- Product
- DedeBIZ
- Classifications
- CWE-77, CWE-74, T1505.003
- Attack vector
- network
- Privileges
- admin
Timeline
How it unfolded
- Dec 14, 2025CVE publishedPublication date reported by the CVE source.
- Dec 14, 2025Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=6.5.0
- Affected versionversion=6.5.1
- Affected versionversion=6.5.2
- Affected versionversion=6.5.3
- Affected versionversion=6.5.4
- Affected versionversion=6.5.5
- Affected versionversion=6.5.6
- Affected versionversion=6.5.7
- Affected versionversion=6.5.8
- Affected versionversion=6.5.9
What conditions does exploitation require?
What is affected?
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Weakness, pattern, technique
Public exploit references
- DedeBIZ PHP file-write proof of conceptproof of concept · demonstrated
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo