| Title | DedeCMS V53_1_UTF8 SQL Injection |
|---|
| Description | DedeCMS V53_1_UTF8 contains an authenticated SQL injection vulnerability in /dede/makehtml_archives_action.php. The startid parameter is directly concatenated into an SQL condition without strict type validation or parameterized queries. An authenticated backend user can inject SQL expressions and disclose sensitive database information through error-based SQL injection, including administrator account data and the database version. The issue was verified with EXTRACTVALUE payloads against startid. Public proof of concept and screenshots: https://github.com/zyb26252/CVE/issues/4. Vendor website: https://www.dedecms.com/ |
|---|
| Source | ⚠️ https://github.com/zyb26252/CVE/issues/4 |
|---|
| User | zybo (UID 82781) |
|---|
| Submission | 09/15/2026 03:30 (1 month ago) |
|---|
| Moderation | 10/05/2026 09:44 (20 days later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 258923 [DedeCMS 5.7.112 makehtml_archives_action.php sql injection] |
|---|
| Points | 0 |
|---|