Executive brief
DedeCMS, a popular content management system, contains a security vulnerability in its SQL Command Line Tool. An attacker with access to the administrative backend can execute unauthorized database commands to steal sensitive information, such as administrator credentials, or delete critical website data. This could lead to a complete takeover of the website or permanent loss of business information.
Technical details
A SQL injection vulnerability exists in the 'sqlquery' parameter of the 'sys_sql_query.php' component in DedeCMS <= V5.7.118. The vulnerability arises because the 'safeCheck' security mechanism, intended to block dangerous SQL operations like data deletion, is explicitly disabled (set to FALSE) in the '/dede/config.php' configuration file. An authenticated attacker can bypass intended restrictions by using error-based SQL injection techniques (e.g., using extractvalue) or by creating malicious database triggers to perform unauthorized data exfiltration or deletion. The backend executes these commands via the ExecuteNoneQuery function in the DedeSqlite/mysqli class without sufficient sanitization.
Affected products
- DedeCMS DedeCMS <= V5.7.118
Timeline
- 2026-07-27: disclosed: Initial disclosure and CVE assignment
- 2026-07-27: advisory: NVD publication date