SQL Injection Vulnerability in DedeCMS by DedeSoft
CVE-2023-27733

7.2HIGH

Key Information:

Vendor

Dedecms

Status
Dedecms
Vendor
CVE Published:
17 April 2023

What is CVE-2023-27733?

DedeCMS versions 5.7.106 and earlier are susceptible to a SQL injection vulnerability via the /dede/sys_sql_query.php component. This weakness could allow an attacker to execute arbitrary SQL queries through the vulnerable endpoint, potentially exposing sensitive data or compromising the database integrity.

References

https://github.com/Ephemeral1y/Vulnerability/blob/master/...
https://sha999-crypto.github.io/2023/02/28/Dedecms%20back...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.