For DedeCMS / 织梦, PHP2Shell remediation requires patching the PHP runtime. The application version helps identify compatibility blockers; it cannot establish exploitability or prove that either CVE is fixed.
DedeCMS / 织梦 - PHP compatibility for the PHP2Shell fix
A trustworthy release-to-PHP mapping is not available here. Do not guess a PHP 8 target from a product name or a modern download page. Identify the exact distribution, patch level and local modifications first.
Identify the PHP2Shell repair scope
Files and package identity
include/common.inc.phpinclude/dedemysql.class.phptemplets/uploads/
DedeCMS / 织梦 - Remove blockers to patch PHP2Shell
Identify original DedeCMS, commercial releases and DedeBIZ forks separately. The current DedeCMS homepage advertises PHP 5.6+, which does not establish a range for every historical 5.7 package. Audit database classes, custom channel models, templates and character encoding offline. Preserve archive/addon tables, uploads and generated article URLs. Do not overwrite a modified production tree with a differently branded distribution. For DedeCMS, inventory the archive table and each enabled channel’s additional table before export; verify the real prefix and relationship keys in your installation. Preserve author/category mappings, template rules and static output paths. Compare record counts and several full articles with images after import; an archives-only export can omit extended fields.
Dependencies and custom code to review
Official upgrade documentation ↗Check site functions after the PHP2Shell fix
Inventory before fixing PHP2Shell
Use an authorized working copy.
php -v
php --ini
php -m
rg -n "mysql_connect|mysql_query|create_function|each\(" includeDedeCMS / 织梦 - PHP2Shell patch verification
Verify both CVE fixes in the PHP actually serving this site. Replace or restart old Web workers, queue workers and replicas. A working homepage or a newer CLI binary is insufficient evidence.
3. Restart and verify every instance ↗