PT-2025-4754 · Unknown · Dingfanzu Cms

Xiaosguang · Published 2025-01-15 · Updated 2025-01-16 · CVE-2025-22976

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions dingfanzuCMS version 1.0

Description The issue allows a local attacker to execute arbitrary code due to incorrect filtering of content at the checkOrder.php shopId module. This enables the attacker to perform SQL injection attacks.

Recommendations For dingfanzuCMS version 1.0, as a temporary workaround, consider disabling the checkOrder.php module until a patch is available. Restrict access to the shopId module to minimize the risk of exploitation. Avoid using the shopId parameter in the affected checkOrder.php endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-22976

Affected Products

Dingfanzu Cms

References · 5

• 🔥 https://github.com/xiaosguang/cve/blob/main/dingfanzu/dingfanzu-CMS%20checkOrder.php%20shopId%20SQL-inject.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-22976 · Security Note
• https://twitter.com/CVEnew/status/1879858804105625769 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1879820451515437248 · Twitter Post
• https://t.me/cvedetector/15548 · Telegram Post