CVE-2026-10607: DedeCMS 5.7.88 SQL Injection in /plus/flink.php

Technical summary

The vulnerability resides in the dede_htmlspecialchars function within /plus/flink.php of DedeCMS 5.7.88. The function fails to properly sanitize the 'msg' parameter before incorporating it into SQL queries, enabling classic SQL injection attacks. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates remote exploitability without authentication or user interaction. CWE-74 (Improper Neutralization of Special Elements) and CWE-89 (SQL Injection) classify the root causes. The availability of public exploit code represents a material increase in exploitation likelihood.

Business impact

Successful exploitation could allow attackers to read sensitive data from the CMS database, including user credentials, content, and configuration information. Attackers may also modify or delete database records, potentially defacing content or disrupting site availability. For organizations running DedeCMS installations—particularly those exposed to untrusted networks—this vulnerability creates immediate risk of data breach and operational disruption.

Affected systems

DedeCMS version 5.7.88 is directly affected. Organizations should verify whether this version is deployed in their environment, including development, staging, and production instances. DedeCMS is primarily used in Chinese-language content management scenarios; however, any publicly exposed instance is at risk regardless of geographic deployment.

Exploitability

The vulnerability is highly exploitable. Network accessibility (AV:N) with no authentication (PR:N) and no user interaction (UI:N) means an unauthenticated remote attacker can exploit it immediately upon network access to the affected endpoint. The existence of publicly available exploit code substantially lowers the barrier to weaponization. Active scanning and exploitation attempts should be anticipated.

Remediation

Immediate action is required. Organizations must upgrade DedeCMS to a patched version that addresses the SQL injection vulnerability—verify the specific patch version with the vendor advisory. If immediate patching is infeasible, implement network-level controls to restrict access to /plus/flink.php and the broader DedeCMS administrative interface. Web application firewalls (WAF) configured to detect and block SQL injection patterns in the 'msg' parameter may provide temporary mitigation pending patching.

Patch guidance

Contact the DedeCMS development team or consult their official advisory for the specific patched version address this CWE-89 SQL injection. Verify patch availability and test in non-production environments before deployment. Given the ease of exploitation, prioritize patching or decommissioning vulnerable instances within days, not weeks. Document the patch version applied for compliance and audit purposes.

Detection guidance

Monitor web server logs and WAF logs for requests to /plus/flink.php containing SQL metacharacters (e.g., quotes, semicolons, UNION, SELECT) in the 'msg' parameter. Implement database activity monitoring to detect anomalous queries executed from the web application account. Search endpoint detection tools and network traffic inspection systems for payloads characteristic of SQL injection attacks against DedeCMS. Log ingestion and SIEM correlation will help identify exploitation attempts in real time.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH severity score (7.3), unauthenticated remote exploitability, public exploit availability, and direct path to database compromise. The combination of ease of exploitation and high impact makes it a priority target for attackers. Organizations running DedeCMS 5.7.88 should treat this as critical infrastructure risk.

Risk score, explained

The CVSS 3.1 score of 7.3 (HIGH) reflects the vulnerability's network accessibility, lack of authentication requirement, low attack complexity, and impact on confidentiality, integrity, and availability. The vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) indicates an attacker can remotely inject SQL without privileges or user interaction, accessing and modifying database contents. While not rated CVSS 9.0+, the practical risk is amplified by public exploit availability and the inherent sensitivity of CMS data.

Frequently asked questions