DeDeCMS EUVD-2026-63187

The DeDeCMS advanced search feature must be deployed and its endpoint /plus/advancedsearch.php must be publicly reachable over HTTP/HTTPS - no authentication is required (PR:N confirmed by CVSS 4.0 vector). The specific vulnerable version is identified as 53_1_UTF8; other versions are not confirmed affected by available data. No special non-default configuration is implied - if the advanced search module is installed and accessible, the vulnerability is exploitable. Exploitation is bounded by low individual CIA impact ratings (VC:L/VI:L/VA:L), meaning the attack yields partial database access rather than full system takeover without additional privilege escalation steps. No user interaction is required.

The CVSS 4.0 base score of 6.9 with vector AV:N/AC:L/AT:N/PR:N/UI:N reflects a highly accessible attack profile - network reachable, low complexity, no authentication, no user interaction required. However, the impact metrics (VC:L/VI:L/VA:L) are assessed as low across all CIA dimensions, suggesting partial database exposure rather than full system compromise from this vector alone. The E:P (exploit publicly available) supplemental metric materially elevates practical risk beyond the base score, as automated SQLi tooling can operationalize this class of vulnerability at scale. EPSS data was not provided in the input, so probabilistic exploitation likelihood cannot be quantified. Absence from CISA KEV suggests no confirmed widespread exploitation at time of analysis, but this is an absence-of-evidence signal, not confirmed safety. The combination of unauthenticated network access and public exploit code represents a real priority for exposed instances, even if the per-exploitation impact is bounded.

A remote unauthenticated attacker sends a crafted HTTP request to a publicly exposed /plus/advancedsearch.php endpoint with a malicious value in the sql parameter - for example, a UNION-based payload to enumerate database table names and extract credential hashes. A public exploit has been disclosed via Feishu (https://uvxbywu62qm.feishu.cn/wiki/X1T5w8jPUinAsVkM0bhcZf4XnHe), and automated tools such as sqlmap can operationalize this attack with minimal configuration, enabling rapid exploitation across internet-exposed DeDeCMS instances.