CVE-2024-3148: DedeCMS 5.7.112 SQL Injection Vulnerability

CVE-2024-3148 Overview

CVE-2024-3148 is a SQL injection vulnerability in DedeCMS 5.7.112, a Chinese content management system. The flaw resides in the dede/makehtml_archives_action.php file, where unsanitized user input is passed into a database query. An authenticated attacker with low privileges can inject arbitrary SQL statements remotely over the network. The vulnerability was publicly disclosed with proof-of-concept details demonstrating time-based blind SQL injection. According to the disclosure record (VDB-258923), the vendor was contacted but did not respond. The issue is tracked under [CWE-89: Improper Neutralization of Special Elements used in an SQL Command].

Critical Impact
Authenticated attackers can extract, modify, or delete database contents and potentially achieve full compromise of the DedeCMS backend.

Affected Products

DedeCMS 5.7.112
dede/makehtml_archives_action.php component
Deployments exposing the dede/ administrative directory

Discovery Timeline

2024-04-02 - CVE-2024-3148 published to NVD with VulDB identifier VDB-258923
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3148

Vulnerability Analysis

The vulnerability exists in dede/makehtml_archives_action.php, an administrative endpoint used to generate static HTML from DedeCMS archives. The script accepts request parameters and incorporates them into a SQL query without proper parameterization or sanitization. This enables an attacker with a valid backend account to break out of the intended query context and execute arbitrary SQL.

Publicly disclosed proof-of-concept material demonstrates time-based blind SQL injection. In this exploitation pattern, the attacker infers query results by observing response delays triggered by conditional SLEEP() payloads. Successful exploitation allows database enumeration, credential theft from the dede_admin table, and modification of CMS content. Refer to the public disclosure on GitHub for technical details.

Root Cause

The root cause is improper neutralization of user-controlled input before it is concatenated into a SQL statement. DedeCMS does not consistently apply prepared statements across administrative scripts. Parameters flow directly into the database layer, allowing SQL syntax to be interpreted as code rather than data.

Attack Vector

The attack originates over the network against the DedeCMS administrative interface. The attacker must hold a low-privilege authenticated session to reach dede/makehtml_archives_action.php. Once authenticated, the attacker submits crafted parameters containing SQL metacharacters and boolean or time-based payloads. No user interaction is required beyond the attacker's own session.

See the VulDB advisory for additional exploitation context.

Detection Methods for CVE-2024-3148

Indicators of Compromise

HTTP requests to dede/makehtml_archives_action.php containing SQL keywords such as SLEEP(, BENCHMARK(, UNION SELECT, or OR 1=1
Unusual response latency spikes on requests to the DedeCMS administrative path, consistent with time-based blind injection
Web server logs showing repeated parameterized requests from a single authenticated session to the archive generation endpoint
Unexpected reads or modifications to the dede_admin and dede_member database tables

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect query and body parameters submitted to dede/*.php for SQL syntax patterns
Enable MySQL general query logging on the DedeCMS backend database and alert on queries containing time-delay functions
Correlate authenticated session activity with anomalous parameter values in access logs

Monitoring Recommendations

Monitor administrative endpoints under dede/ for requests from IP addresses outside expected administrator ranges
Track failed and successful admin logins against subsequent access to archive management scripts
Alert on outbound data transfers from the CMS host that exceed baseline volumes, indicating potential database exfiltration

How to Mitigate CVE-2024-3148

Immediate Actions Required

Restrict network access to the dede/ administrative directory using IP allowlists at the web server or firewall
Rotate all DedeCMS administrator credentials and enforce strong password policies
Review database audit logs for signs of injection attempts against makehtml_archives_action.php
Reduce the number of accounts with backend access to the minimum required

Patch Information

No vendor patch is available. The disclosure record notes that the DedeCMS maintainers were contacted but did not respond. Organizations continuing to run DedeCMS 5.7.112 should treat the deployment as unmaintained and plan migration to a supported CMS platform.

Workarounds

Place the DedeCMS administrative interface behind a VPN or zero-trust access proxy so that only authenticated network paths can reach dede/*.php
Deploy a WAF with SQL injection signatures tuned to inspect parameters sent to makehtml_archives_action.php
Disable or remove the makehtml_archives_action.php script if the static HTML generation feature is not required
Apply least-privilege database credentials so the DedeCMS database user cannot access unrelated schemas or execute administrative statements

bash

# Example nginx configuration restricting access to the DedeCMS admin directory
location ^~ /dede/ {
    allow 10.0.0.0/24;   # trusted admin network
    deny all;
    try_files $uri $uri/ =404;
}