PT-2025-45592 · Dedebiz · Dedebiz

Zzctd · Published 2025-11-10 · Updated 2025-11-10 · CVE-2025-12927

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DedeBIZ versions up to 6.3.2

Description A security issue exists in DedeBIZ that allows for SQL injection. The issue is located in the file /admin/archives add.php. Manipulation of the flags[] argument can lead to successful exploitation. The attack can be carried out remotely. The exploit for this issue has been publicly disclosed.

Recommendations Versions prior to 6.3.2 should be updated. As a temporary workaround, restrict access to the /admin/archives add.php file.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-12927

Affected Products

Dedebiz

References · 10

• 🔥 https://github.com/ZZCTD/zz_test/issues/4 · Exploit
• https://osv.dev/vulnerability/CVE-2025-12927 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12927 · Security Note
• https://t.me/cveNotify/142238 · Telegram Post
• https://vuldb.com/?submit.681507 · Note
• https://vuldb.com/?id.331647 · Note
• https://twitter.com/VulmonFeeds/status/1987758455000531213 · Twitter Post
• https://vuldb.com/?ctiid.331647 · Note
• https://t.me/CVEtracker/36887 · Telegram Post
• https://twitter.com/CVEnew/status/1987729281812750793 · Twitter Post