CVE-2026-10606: DedeCMS 5.7.88 SQL Injection in Feedback Handler

Technical summary

CVE-2026-10606 is a SQL injection vulnerability in DedeCMS 5.7.88 affecting the TrimMsg function within /plus/feedback.php. The vulnerability stems from improper input validation on the msg parameter, allowing an attacker to break out of the intended SQL context and execute arbitrary database queries. The vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output) and CWE-89 (SQL Injection), indicating both the root cause and the resultant attack vector. With a CVSS 3.1 score of 7.3 and a network-accessible attack surface requiring no privileges or user interaction, the vulnerability is readily exploitable.

Business impact

A successful SQL injection attack via this vulnerability could allow an attacker to read, modify, or delete database records, potentially compromising sensitive customer data, user credentials, and system integrity. For organizations using DedeCMS as their content management platform, this could result in unauthorized data disclosure, defacement, or loss of service availability. The public disclosure of this vulnerability increases the window of exposure and the likelihood of opportunistic attacks targeting unpatched instances.

Affected systems

DedeCMS version 5.7.88 is explicitly affected. Organizations running this version—particularly those with publicly accessible feedback forms—face direct risk. Other versions of DedeCMS may be vulnerable depending on their codebase; however, only version 5.7.88 is confirmed in this advisory. Verify your deployment version and consult DedeCMS security advisories for information on other potentially affected releases.

Exploitability

This vulnerability is highly exploitable. The attack requires no authentication, no special privileges, and no user interaction—an attacker need only craft a malicious request to the feedback endpoint with a specially crafted msg parameter. The public disclosure means that proof-of-concept code or attack patterns may be widely available. The combination of network accessibility, low attack complexity, and no prerequisites makes this a high-priority target for automated scanning and exploitation campaigns.

Remediation

Immediate patching is the primary remediation. Contact the DedeCMS vendor to obtain and deploy the latest security patch for version 5.7.88 or upgrade to a newer, patched release. In the interim, implement network-level access controls to restrict who can reach the /plus/feedback.php endpoint, disable the feedback functionality if not essential, or apply Web Application Firewall (WAF) rules to detect and block SQL injection attempts targeting the msg parameter. Input validation and parameterized query review should be part of any security hardening effort.

Patch guidance

Check the DedeCMS project repository and official security advisories for available patches. Apply the latest security update for your DedeCMS installation. After patching, validate that the feedback functionality operates normally and that your application logs show no anomalies. Consider testing patches in a non-production environment before deploying to production systems. If upgrading to a new major version, review compatibility with any custom modules or extensions.

Detection guidance

Monitor access logs for unusual patterns targeting /plus/feedback.php, particularly requests with encoded or obfuscated payloads in the msg parameter. Web Application Firewall signatures for SQL injection (e.g., SQL keywords like UNION, SELECT, DROP in parameter values) should be deployed and tuned. Intrusion detection systems can flag requests containing common SQL injection syntax. Database query logs should be reviewed for unexpected queries originating from the web application. Consider implementing alerting for failed SQL parsing or database errors logged in conjunction with feedback submissions.

Why prioritize this

This vulnerability warrants high-priority remediation due to the combination of high CVSS score (7.3), public disclosure increasing exploit availability, network-accessible attack surface, and no authentication requirement. The data confidentiality, integrity, and availability impacts are all present (per the CVSS vector), and SQL injection vulnerabilities are among the most commonly exploited weaknesses in web applications. Any DedeCMS 5.7.88 instance with internet-facing feedback forms is an immediate target.

Risk score, explained

The CVSS 3.1 score of 7.3 (HIGH) reflects a network-accessible SQL injection with no authentication barriers and significant impact across confidentiality, integrity, and availability. The complete CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L indicates network-based attack, low complexity, no privileges or user interaction needed, and localized (not cross-boundary) scope with partial impacts on all three security properties. The public disclosure status and lack of KEV status do not lower the intrinsic risk but do increase the practical exploitation timeline.

Frequently asked questions