CVE-2026-10608: DedeCMS 5.7.88 SQL Injection Vulnerability

CVE-2026-10608 Overview

CVE-2026-10608 is a SQL injection vulnerability in DedeCMS 5.7.88. The flaw resides in the RemoveXSS function within /plus/carbuyaction.php. Attackers can manipulate the postname and des parameters to inject arbitrary SQL statements. The vulnerability is remotely exploitable without authentication or user interaction. Public exploit details have been released, increasing the likelihood of opportunistic attacks against exposed DedeCMS installations. The issue is classified under [CWE-74] — Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection).

Critical Impact

Unauthenticated remote attackers can manipulate postname and des parameters to inject SQL, enabling database read, modification, or extraction of sensitive content.

Affected Products

• DedeCMS 5.7.88
• Component: /plus/carbuyaction.php
• Function: RemoveXSS

Discovery Timeline

• 2026-06-02 - CVE-2026-10608 published to NVD
• 2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-10608

Vulnerability Analysis

The vulnerability exists in DedeCMS 5.7.88, an open-source PHP-based content management system. The affected code path runs through the RemoveXSS sanitization routine called from /plus/carbuyaction.php. While RemoveXSS is intended to strip cross-site scripting payloads, it does not neutralize SQL metacharacters before the postname and des arguments are concatenated into database queries. Attackers reach this code over the network without authentication. Successful exploitation allows reading or modifying database content within the privileges of the DedeCMS database user. Public proof-of-concept information is referenced on VulDB CVE-2026-10608.

Root Cause

The root cause is improper input neutralization [CWE-74]. The RemoveXSS function focuses on HTML and script tag filtering rather than SQL syntax. Parameter values from postname and des flow into SQL statements without parameterized queries or proper escaping. This design conflates XSS sanitization with database safety, leaving SQL grammar tokens intact.

Attack Vector

A remote attacker issues a crafted HTTP request to /plus/carbuyaction.php containing malicious payloads in the postname or des parameters. The attacker requires no credentials and no user interaction. The injected SQL executes in the application's database context, potentially exposing CMS user records, content tables, and configuration data. Details on the submitted research are available at VulDB Vulnerability #367915.

Detection Methods for CVE-2026-10608

Indicators of Compromise

• HTTP requests to /plus/carbuyaction.php containing SQL metacharacters such as ', --, UNION SELECT, or SLEEP( in postname or des parameters.
• Web server access logs showing anomalously long or encoded values for postname or des.
• Database error messages referencing carbuyaction.php in DedeCMS error logs.
• Unexpected outbound connections from the web server after requests to carbuyaction.php.

Detection Strategies

• Deploy web application firewall (WAF) signatures that flag SQL injection patterns targeting DedeCMS /plus/ endpoints.
• Inspect HTTP request bodies and query strings for SQL keywords combined with the carbuyaction.php path.
• Correlate web access logs with database query logs to identify unexpected query structures originating from the CMS user.

Monitoring Recommendations

• Enable verbose request logging for all /plus/*.php endpoints in DedeCMS deployments.
• Forward web and database logs to a centralized analytics platform for query anomaly detection.
• Alert on repeated 500-series responses from carbuyaction.php, which may indicate failed injection attempts.

How to Mitigate CVE-2026-10608

Immediate Actions Required

• Restrict public access to /plus/carbuyaction.php via web server access control lists until a vendor patch is applied.
• Apply WAF rules to block SQL metacharacters in the postname and des parameters.
• Audit DedeCMS database accounts and revoke unnecessary privileges to limit injection impact.
• Review existing logs for evidence of prior exploitation against carbuyaction.php.

Patch Information

No official vendor patch is referenced in the published advisory at the time of NVD publication. Administrators should monitor the DedeCMS project channels and VulDB entry #367915 for updated remediation guidance. Until a fix is released, replace RemoveXSS-based sanitization with parameterized SQL queries or prepared statements for any code path consuming postname or des.

Workarounds

• Disable or remove /plus/carbuyaction.php if the car-buy action feature is not in use.
• Add server-side input validation that rejects non-alphanumeric values for postname and des.
• Enforce least-privilege database credentials for the DedeCMS application user, removing FILE, DROP, and administrative grants.
• Place the DedeCMS instance behind a reverse proxy with rule-based filtering for /plus/ endpoints.

# Example Nginx rule to block suspicious parameters on the affected endpoint
location = /plus/carbuyaction.php {
    if ($args ~* "(union|select|sleep\(|--|';|/\*)") {
        return 403;
    }
    proxy_pass http://dedecms_backend;
}