CVE-2026-10606: DedeCMS 5.7.88 SQL Injection Vulnerability

CVE-2026-10606 Overview

CVE-2026-10606 is a SQL injection vulnerability in DedeCMS 5.7.88. The flaw resides in the TrimMsg function within /plus/feedback.php, part of the Feedback Handler component. Attackers can manipulate the msg argument to inject arbitrary SQL statements into the underlying database query. The vulnerability is remotely exploitable without authentication or user interaction. Public disclosure of the exploit technique has occurred, increasing the risk of opportunistic exploitation against exposed DedeCMS instances. The weakness is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact

Unauthenticated remote attackers can inject SQL queries through the feedback msg parameter, potentially exposing or modifying database contents on DedeCMS 5.7.88 deployments.

Affected Products

• DedeCMS 5.7.88
• Component: Feedback Handler (/plus/feedback.php)
• Function: TrimMsg

Discovery Timeline

• 2026-06-02 - CVE-2026-10606 published to NVD
• 2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-10606

Vulnerability Analysis

The vulnerability exists in the TrimMsg function inside /plus/feedback.php, which processes user-submitted feedback content. The msg argument is incorporated into a SQL query without sufficient sanitization or parameterization. An attacker submits a crafted msg value to the feedback endpoint, and the injected SQL fragment executes against the backing database.

Because the Feedback Handler is reachable over HTTP without prior authentication, exploitation requires only network access to the application. Successful injection can disclose, modify, or delete records held in the DedeCMS database, depending on the privileges of the database user configured for the application.

Root Cause

The root cause is improper neutralization of special elements ([CWE-74]) in the TrimMsg routine. The function fails to enforce parameterized queries or apply context-aware escaping before concatenating attacker-controlled input into a SQL statement.

Attack Vector

The attack vector is network-based. An adversary sends an HTTP request to /plus/feedback.php containing a malicious msg parameter. No credentials, privileges, or user interaction are required. The exploit has been publicly disclosed, lowering the technical barrier for reuse against internet-facing DedeCMS 5.7.88 sites.

No verified proof-of-concept code is reproduced here. Refer to the VulDB entry for CVE-2026-10606 and VulDB Vulnerability #367913 for technical disclosure details.

Detection Methods for CVE-2026-10606

Indicators of Compromise

• HTTP POST or GET requests to /plus/feedback.php containing SQL metacharacters such as single quotes, UNION SELECT, SLEEP(, or comment sequences (--, #) in the msg parameter.
• Unusual database error messages logged by the DedeCMS application or its MySQL/MariaDB backend following feedback submissions.
• Spikes in feedback submissions from a single source IP, particularly with abnormally long or encoded msg payloads.

Detection Strategies

• Inspect web server access logs for requests targeting /plus/feedback.php with suspicious msg values and flag anomalous query lengths or encodings.
• Deploy web application firewall (WAF) signatures for SQL injection patterns, scoped to the DedeCMS feedback endpoint.
• Correlate database query logs with feedback submissions to identify unexpected SELECT, UNION, or schema-enumeration activity.

Monitoring Recommendations

• Forward web server and database logs to a centralized analytics platform for query-time inspection and historical hunting.
• Alert on outbound database errors returned in HTTP responses originating from /plus/feedback.php.
• Track repeated feedback submissions from the same client during short time windows as a possible automated injection probe.

How to Mitigate CVE-2026-10606

Immediate Actions Required

• Restrict public access to /plus/feedback.php until a vendor patch is verified and applied.
• Apply WAF rules that block SQL metacharacters in the msg parameter for the Feedback Handler endpoint.
• Audit the DedeCMS database account permissions and remove unnecessary privileges to limit the blast radius of any successful injection.

Patch Information

No vendor patch is referenced in the available CVE data at the time of publication. Monitor the DedeCMS project channels and the VulDB advisories listed under VulDB Submission #829413 for fixed releases.

Workarounds

• Disable the feedback module in DedeCMS configuration if the functionality is not required for the site.
• Enforce input validation at the reverse proxy or WAF layer, rejecting msg values that contain SQL keywords or unusual characters.
• Configure the database account used by DedeCMS with read-limited privileges where feasible to reduce the impact of injection.

# Example WAF/nginx snippet to block obvious SQLi patterns on the feedback endpoint
location = /plus/feedback.php {
    if ($args ~* "(union|select|sleep\(|information_schema|--|;)") {
        return 403;
    }
    if ($request_body ~* "(union|select|sleep\(|information_schema|--|;)") {
        return 403;
    }
    proxy_pass http://dedecms_backend;
}