CVE-2024-2822

A vulnerability, which was classified as problematic, was found in DedeCMS 5.7. This affects an unknown part of the file /src/dede/vote_edit.php. The manipulation of the argument aid leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257709 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-352

• https://github.com/E1CHO/demo/blob/main/29.pdfExploit, Third Party Advisory
• https://vuldb.com/?ctiid.257709Permissions Required, VDB Entry
• https://vuldb.com/?id.257709Third Party Advisory, VDB Entry
• https://github.com/E1CHO/demo/blob/main/29.pdfExploit, Third Party Advisory
• https://vuldb.com/?ctiid.257709Permissions Required, VDB Entry
• https://vuldb.com/?id.257709Third Party Advisory, VDB Entry

Published

Mar 22, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-28212nGrinder before 3.5.9 uses old version of SnakeYAML, which c…9.8
• CVE-2024-28213nGrinder before 3.5.9 allows to accept serialized Java objec…9.8
• CVE-2024-28214nGrinder before 3.5.9 allows to set delay without limitation…2.7
• CVE-2024-28215nGrinder before 3.5.9 allows an attacker to create or update…7.5
• CVE-2024-28216nGrinder before 3.5.9 allows an attacker to obtain the resul…5.4
• CVE-2024-28219In _imagingcms.c in Pillow before 10.3.0, a buffer overflow …5.9
• CVE-2024-28222In Veritas NetBackup before 8.1.2 and NetBackup Appliance be…9.8
• CVE-2024-28224Ollama before 0.1.29 has a DNS rebinding vulnerability that …6.6
• CVE-2024-28226in OpenHarmony v4.0.0 and prior versions allow a remote atta…7.5
• CVE-2024-28228In JetBrains YouTrack before 2024.1.25893 creation comments …5.3
• CVE-2024-28229In JetBrains YouTrack before 2024.1.25893 user without appro…6.5
• CVE-2024-2823A vulnerability has been found in DedeCMS 5.7 and classified…4.3