CVE-2026-10608: DedeCMS 5.7.88 SQL Injection in carbuyaction.php - Critical Patch Required

Technical summary

The vulnerability exists in the RemoveXSS function of /plus/carbuyaction.php in DedeCMS 5.7.88, where insufficient input sanitization on the postname and des parameters permits SQL injection. The flaw combines improper input validation (CWE-74) with classic SQL injection techniques (CWE-89). An unauthenticated remote attacker can craft malicious HTTP requests to manipulate SQL queries executed by the application, bypassing authentication controls entirely.

Business impact

Successful exploitation enables attackers to read, modify, or delete database records, potentially exposing sensitive content management data, user credentials, or site configuration details. Depending on database permissions and CMS configuration, attackers could gain administrative control, modify website content, or pivot to other systems sharing database credentials. The public availability of exploit code significantly accelerates attack likelihood.

Affected systems

DedeCMS version 5.7.88 is confirmed vulnerable. Organizations running this version should assume systems are at risk if exposed to network traffic from untrusted sources. Verify your DedeCMS installation version immediately; versions before and after 5.7.88 should be evaluated against vendor advisory documentation to determine if they are affected.

Exploitability

This vulnerability rates as highly exploitable: it requires no authentication, no user interaction, and minimal network complexity. The attack vector is network-based and can be triggered via simple HTTP requests. Public disclosure of exploit code means attackers have a weaponized attack path available, significantly shortening time-to-exploitation for threat actors.

Remediation

Update DedeCMS to a patched version released by the vendor that addresses this SQL injection flaw. If an immediate patch is unavailable, implement network segmentation to restrict access to /plus/carbuyaction.php to trusted internal networks only. Apply Web Application Firewall (WAF) rules to block requests containing SQL metacharacters in the postname and des parameters.

Patch guidance

Contact the DedeCMS vendor or check their official security advisory for the specific patched version addressing CVE-2026-10608. Apply patches immediately upon availability, as public exploits increase attack surface. Test patches in a staging environment before production deployment to ensure compatibility with custom extensions or configurations.

Detection guidance

Monitor web server logs for HTTP POST/GET requests to /plus/carbuyaction.php containing SQL keywords (SELECT, UNION, DROP, INSERT, etc.) in the postname or des parameters. Deploy WAF rules to flag requests with SQL metacharacters ('--', ';', '/*', etc.) in those parameters. Monitor database query logs for suspicious or malformed SQL statements originating from the web application. Network intrusion detection systems should flag connections to the vulnerable endpoint from external sources.

Why prioritize this

HIGH severity (CVSS 7.3) combined with public exploit availability and zero authentication requirements demands immediate attention. This is not a theoretical vulnerability—attack code exists in the wild. Any organization running DedeCMS 5.7.88 should prioritize patching within 24-48 hours, and those unable to patch immediately must implement compensating controls.

Risk score, explained

The CVSS 7.3 score reflects a network-exploitable, unauthenticated attack requiring minimal complexity that impacts all three security pillars: confidentiality (database read access), integrity (content modification), and availability (potential database disruption). The absence of user interaction and the ease of exploitation elevate risk beyond the base score; public exploit availability further increases likelihood of real-world attack.

Frequently asked questions