EUVD-2026-49640
GHSA-9xj5-jjmx-4r4q
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Remote unauthenticated access, low attack complexity, no user interaction, and high confidentiality impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the sqlquery parameter of the sys_sql_query.php component
AnalysisAI
SQL injection in Dede CMS 5.7.118 via the sqlquery parameter of sys_sql_query.php allows unauthenticated remote attackers to extract arbitrary database contents, including sensitive information. A publicly available proof-of-concept exploit exists, although no active exploitation has been confirmed.
Technical ContextAI
Dede CMS is a PHP-based content management system. The vulnerability lies in the sys_sql_query.php component, which fails to properly sanitize the sqlquery parameter before using it in SQL queries, resulting in CWE-89 SQL injection. The affected product is identified generically as cpe:2.3:a:n/a:n/a, but the description explicitly targets Dede CMS version 5.7.118. The flaw permits an attacker to execute arbitrary SQL statements through crafted HTTP requests, leading to information disclosure.
RemediationAI
No vendor-released patch has been identified at time of analysis. As a workaround, restrict access to the sys_sql_query.php endpoint (e.g., via web server access controls or firewall rules), and disable or remove the SQL query feature if it is not essential. Monitor database query logs for suspicious activity. Check dedecms.com for any future updates addressing this issue.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today