PT-2023-21310 · Dedecms · Dedecms

Sha · Published 2023-04-17 · Updated 2023-04-26 · CVE-2023-27733

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DedeCMS version 5.7.106

Description A SQL injection issue was found in DedeCMS via the component /dede/sys sql query.php. This allows for potential exploitation.

Recommendations For DedeCMS version 5.7.106, update to a version that fixes this issue to prevent SQL injection attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-27733

Affected Products

Dedecms

References · 8

• 🔥 https://github.com/Ephemeral1y/Vulnerability/blob/master/DedeCMS/5.7.98/DedeCMS-v5.7.98-RCE.md · Exploit
• 🔥 https://sha999-crypto.github.io/2023/02/28/Dedecms%20background%20SQL%20injection%20vulnerability · Exploit
• https://osv.dev/vulnerability/CVE-2023-27733 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27733 · Security Note
• https://t.me/cvenotify/49132 · Telegram Post
• https://t.me/cibsecurity/62289 · Telegram Post
• https://t.me/cvenotify/48417 · Telegram Post
• https://t.me/cvenotify/48398 · Telegram Post