Is there a public PoC exploit available for CVE-2025-15004?

Yes, a public proof-of-concept exploit is available for CVE-2025-15004. Prioritise patching immediately. EPSS: 0.1%.

DedeCMS CVE-2025-15004

Q: What is the CVSS score of CVE-2025-15004?

CVE-2025-15004 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-12-22 cna@vuldb.com

PHP SQLi Dedecms

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:43 vuln.today

DescriptionCVE.org

A vulnerability was identified in DedeCMS up to 5.7.118. This impacts an unknown function of the file /freelist_main.php. The manipulation of the argument orderby leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in DedeCMS up to version 5.7.118 via the orderby parameter in /freelist_main.php allows authenticated remote attackers to execute arbitrary SQL queries with low impact on confidentiality, integrity, and availability. Publicly available exploit code exists and the vulnerability requires valid user authentication (PR:L) to exploit, significantly limiting real-world risk despite network accessibility.

Technical ContextAI

DedeCMS is a PHP-based open-source content management system. The vulnerability exists in the /freelist_main.php file, where the orderby parameter is passed to a database query without proper input validation or parameterized query protection. This represents a classic CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) vulnerability where user-supplied input is not sanitized before being incorporated into SQL statements. The attack vector is network-based (AV:N), exploitable with low attack complexity (AC:L), and requires authenticated access (PR:L), indicating the parameter handling fails to implement prepared statements or input filtering for database operations.

RemediationAI

Upgrade DedeCMS to a version newer than 5.7.118 that includes input validation and parameterized query fixes for the orderby parameter in /freelist_main.php. If immediate upgrade is not feasible, implement Web Application Firewall (WAF) rules to block requests containing SQL keywords (SELECT, UNION, OR, AND) in the orderby parameter, though this may cause false positives on legitimate queries. Apply strict input validation at the application layer to accept only whitelisted column names for the orderby parameter (e.g., regex pattern matching against allowed field names). Restrict access to /freelist_main.php to trusted internal networks or authenticated users with minimal privilege levels. Review DedeCMS security advisories and vendor documentation for patch availability and release notes confirming SQL injection fixes.