DedeCMS Local File Inclusion (LFI) Vulnerability in carbuyaction.php (CVE-2010-20125)

1. Official Patch Upgrade to DedeCMS v5.7 or the latest available version from the official repository.

2. Manual Hotfix If an immediate upgrade is not feasible, modify `plus/carbuyaction.php` to ensure the `$code` variable is properly sanitized and initialized:

// Example fix for plus/carbuyaction.php
$code = preg_replace('/[^a-zA-Z0-9]/', '', $_GET['code'] ?? 'default');
$target_file = DEDEPAY."/payment/{$code}.php";
if (!file_exists($target_file)) {
    die("Access Denied");
}

3. Network Level Mitigation Deploy WAF rules to intercept and block requests containing directory traversal patterns in the URI or query parameters (e.g., `../`, `..\`, `%2e%2e%2f`).

This vulnerability is a classic Local File Inclusion (LFI) residing in plus/carbuyaction.php of DedeCMS. The root cause is the use of an uninitialized $code parameter which is subsequently passed to a require_once statement (CWE-98). An attacker can manipulate this parameter using path traversal sequences like ../../ to bypass the intended directory restrictions. This allows the inclusion and execution (as PHP) or disclosure of arbitrary files on the local file system. Recent threat intelligence from Shadowserver indicates active exploitation attempts as of late 2023, highlighting the continued risk to legacy installations.