Executive brief
DedeCMS, a popular content management system, contains a security flaw in its shopping cart processing component. An attacker can exploit this to interfere with the website's database, potentially leading to the unauthorized viewing or modification of sensitive data. This vulnerability can be exploited remotely without needing a username or password, and public exploit code is currently available.
Technical details
A SQL injection vulnerability exists in DedeCMS 5.7.88 within the /plus/carbuyaction.php file. The issue resides in the RemoveXSS function, where improper neutralization of special elements occurs when handling the 'postname' and 'des' arguments. An unauthenticated remote attacker can exploit this by sending crafted HTTP requests to manipulate backend SQL queries. This can lead to unauthorized data retrieval, modification, or deletion within the database. Public exploit code has been released, increasing the risk of active exploitation.
Affected products
- DedeCMS DedeCMS 5.7.88
Timeline
- 2026-06-02: disclosed: Vulnerability published and exploit released to the public.
- 2026-06-02: advisory