CVE-2024-33749

The vulnerability results from improper authorization verification in the mail_file_manage.php file — the script does not properly check whether the requesting user has the right to perform the file deletion operation. An attacker can send a specially crafted network request pointing to any file on the server and cause its deletion. Due to the network vector (AV:N), lack of authentication requirement (PR:N), and no user interaction (UI:N), the attack is possible remotely without any credentials.

An attacker can permanently delete any files accessible from the web server process, which may lead to data integrity loss, destruction of application configuration, or complete service disruption (denial of service).

Patches available from the vendor should be applied in accordance with the references. As an interim workaround, it is recommended to restrict access to the mail_file_manage.php file at the web server level or application firewall (WAF) to trusted IP addresses.

DedeCMS version V5.7.114