DedeCMS CVE-2025-15004

Exploitation requires authenticated access to DedeCMS (PR:L in CVSS vector) - an attacker must possess valid login credentials or have compromised an existing user account. The vulnerable endpoint /freelist_main.php must be accessible and processing the orderby parameter through unsafe SQL concatenation without prepared statements. No special DedeCMS configuration is mentioned in the description, suggesting the default installation is vulnerable. The vulnerability does not require user interaction (UI:N) once authenticated. Limiting factors: authentication requirement significantly restricts attack surface; low impact scores (VC:L, VI:L, VA:L) mean successful exploitation does not grant system-level access or cause service disruption; the orderby parameter may be restricted to specific field names in some deployments, limiting injection payloads.

Despite the publicly available exploit code and network accessibility, real-world risk is substantially mitigated by authentication requirements. The CVSS v4.0 vector shows PR:L (requires login), limiting the attack surface to registered users or compromised accounts rather than anonymous attackers. EPSS score of 0.05% (17th percentile) indicates very low exploitation probability in the wild, suggesting this vulnerability is either not widely targeted, heavily patched in production environments, or requires conditions not commonly met. The low impact scores (VC:L, VI:L, VA:L) confirm that successful exploitation provides only limited unauthorized data access, not system compromise. The presence of a public POC without confirmed active exploitation in CISA KEV indicates proof-of-concept availability does not translate to widespread weaponization. Security teams should prioritize this below remote unauthenticated SQL injection vulnerabilities but should still remediate in systems where DedeCMS users have untrusted access.

An authenticated DedeCMS user with account access (obtained either through legitimate registration or credential compromise) crafts a malicious request to /freelist_main.php with a specially formatted orderby parameter containing SQL metacharacters such as UNION SELECT or OR 1=1. The application concatenates this unsanitized input directly into a database query, allowing the attacker to extract sensitive data from other database tables or bypass access controls. The exploit requires valid login credentials, making it primarily a risk in scenarios where user accounts are compromised or where public registration is enabled.