Description

A security vulnerability has been detected in DeDeCMS 53_1_UTF8. This vulnerability affects unknown code of the file /plus/advancedsearch.php. Such manipulation of the argument sql leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-20T01:16:53.923Z",
  "pubdate": "2026-08-20T01:16:53.923Z",
  "executiveSummary": "A security vulnerability has been identified in DeDeCMS version 53_1_UTF8, specifically within the /plus/advancedsearch.php script. The vulnerability involves a SQL injection flaw stemming from the improper handling of user-supplied input passed via the sql argument. This weakness allows remote, unauthenticated attackers to manipulate database queries directly, posing severe risks to the confidentiality, integrity, and availability of the underlying database management system. Because exploit details have been publicly disclosed, the risk of active exploitation in the wild is significantly heightened. Successful exploitation enables unauthorized actors to execute arbitrary SQL commands, potentially leading to unauthorized data access, data exfiltration, or complete database compromise without requiring prior system access or privileged credentials.",
  "technicalDetails": "The vulnerability is rooted in the insecure processing of HTTP request parameters within the vulnerable component located at /plus/advancedsearch.php in DeDeCMS 53_1_UTF8. Specifically, the application fails to adequately sanitize, validate, or parameterize the sql argument before incorporating it into dynamic database queries executed by the backend database management system.\nThe attack flow begins when a remote attacker crafts a malicious HTTP request targeting the /plus/advancedsearch.php endpoint. By injecting specially crafted SQL syntax into the sql parameter, the attacker alters the intended logical structure of the database query. Because the application blindly trusts and executes the concatenated input, the database server interprets the malicious payload as legitimate SQL commands.\nNetwork exposure for this vulnerability is remote, meaning that any network-accessible adversary capable of reaching the web application can initiate the attack vector. The exploitation process does not require authentication or specific user privileges, lowering the barrier to entry for malicious actors. Depending on the configuration of the database permissions, the resulting post-exploitation impact can range from the retrieval of sensitive application data, such as administrator credentials and user PII, to potential operating system command execution if database features like stacked queries or file read/write operations are supported and enabled.\nThe root cause is a lack of input sanitization and the absence of parameterized queries or prepared statements within the affected script, which allows untrusted user input to directly influence the execution context of SQL statements."
}