Is there a public PoC exploit available for CVE-2025-14648?

Yes, a public proof-of-concept exploit is available for CVE-2025-14648. Prioritise patching immediately. EPSS: 0.3%.

DedeBIZ CVE-2025-14648

Q: What is the CVSS score of CVE-2025-14648?

CVE-2025-14648 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-12-14 cna@vuldb.com

PHP Command Injection Dedebiz

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 02:46 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in DedeBIZ up to 6.5.9. Affected by this vulnerability is an unknown functionality of the file /src/admin/catalog_add.php. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

Command injection in DedeBIZ up to version 6.5.9 allows authenticated high-privilege administrators to execute arbitrary system commands via the /src/admin/catalog_add.php endpoint. The vulnerability requires high-privilege authentication (PR:H in CVSS v4.0) and has publicly available exploit code, but real-world risk is constrained by the authentication requirement and limited scope of impact (CVSS 2.0, EPSS 0.28%).

Technical ContextAI

DedeBIZ is a PHP-based e-commerce or content management system. The vulnerability exists in the catalog_add.php file within the admin module, a common location for administrative functionality in PHP applications. CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) indicates insufficient input validation or output encoding when processing user-supplied data, allowing shell metacharacters or command separators to pass through to a system command execution function. The attack likely exploits inadequate sanitization before passing user input to functions such as exec(), system(), passthru(), or shell_exec() in PHP.

RemediationAI

Upgrade DedeBIZ to a version newer than 6.5.9 once available from the vendor; no specific patched version number has been confirmed in available data. As immediate mitigation, restrict administrative access in /src/admin/catalog_add.php to trusted IP addresses via web server configuration (Apache .htaccess or nginx location blocks), and review audit logs for unauthorized high-privilege account activity. Implement input validation on all parameters passed to the catalog_add.php endpoint-specifically, reject or properly escape shell metacharacters (semicolons, pipes, backticks, dollar signs, parentheses) before any system function call. Consider disabling the catalog add functionality entirely if not in use. Monitor for exploitation attempts by auditing web server access logs for POST/GET requests to this endpoint from unexpected sources or during off-hours.