| 标题 | DedeCMS V53_1_UTF8 SQL Injection |
|---|
| 描述 | DedeCMS V53_1_UTF8 contains an authenticated SQL injection vulnerability in /dede/makehtml_archives_action.php. The startid parameter is directly concatenated into an SQL condition without strict type validation or parameterized queries. An authenticated backend user can inject SQL expressions and disclose sensitive database information through error-based SQL injection, including administrator account data and the database version. The issue was verified with EXTRACTVALUE payloads against startid. Public proof of concept and screenshots: https://github.com/zyb26252/CVE/issues/4. Vendor website: https://www.dedecms.com/ |
|---|
| 来源 | ⚠️ https://github.com/zyb26252/CVE/issues/4 |
|---|
| 用户 | zybo (UID 82781) |
|---|
| 提交 | 2026-09-15 03時30分 (21 日前) |
|---|
| 管理 | 2026-10-05 09時44分 (20 days later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 258923 [DedeCMS 5.7.112 makehtml_archives_action.php SQL注入] |
|---|
| 积分 | 0 |
|---|