---
id: CVE-2014-125131
title: DedeCMS 5.6 / 5.7 Reflected XSS via adminDirHand in config.php
summary: >-
  DedeCMS 5.6 and 5.7 contains a reflected cross-site scripting vulnerability
  that allows unauthenticated attackers to inject script by supplying
  unsanitized input to the adminDirHand parameter. Attackers can send crafted
  GET requests to /…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: DedeCMS
product: DedeCMS
affected:
  - DedeCMS 5.6
  - DedeCMS 5.7
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T20:31:21.514Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2014-125131'
references:
  - url: 'https://www.cnblogs.com/milantgh/p/3615853.html'
    label: CN-Blogs Entry
  - url: >-
      https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/dedecms/dedecms-config-xss.yaml
    label: Nuclei Template
  - url: 'https://www.dedecms.com/'
    label: Product Webpage
  - url: >-
      https://www.vulncheck.com/advisories/dedecms-5.6-5.7-reflected-xss-via-admindirhand-in-config-php
    label: >-
      VulnCheck Advisory: DedeCMS 5.6 / 5.7 Reflected XSS via adminDirHand in
      config.php
tags:
  - cve.org
ingestedAt: '2026-10-20T21:19:21.266Z'
---

## Overview

DedeCMS 5.6 and 5.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input to the adminDirHand parameter. Attackers can send crafted GET requests to /include/dialog/config.php that close the generated script tag and inject JavaScript, which executes in the victim's browser. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-23.

## Affected

- `DedeCMS 5.6`
- `DedeCMS 5.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.