CVE-2026-51077: Dede CMS SQL Injection Vulnerability

CVE-2026-51077 Overview

CVE-2026-51077 is a SQL injection vulnerability [CWE-89] in Dede CMS version 5.7.118. The flaw resides in the sys_sql_query.php component, where the sqlquery parameter is passed to the database engine without proper sanitization. A remote, unauthenticated attacker can inject arbitrary SQL statements over the network to read sensitive data from the backend database.

Critical Impact
Remote attackers can extract sensitive database contents from Dede CMS 5.7.118 installations by injecting SQL through the sqlquery parameter of sys_sql_query.php.

Affected Products

Dede CMS 5.7.118
sys_sql_query.php administrative component
Deployments exposing the affected endpoint to untrusted networks

Discovery Timeline

2026-07-27 - CVE-2026-51077 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-51077

Vulnerability Analysis

Dede CMS is a widely deployed content management system originating from the DedeCMS project. Version 5.7.118 exposes the sys_sql_query.php script, which accepts a user-supplied sqlquery parameter intended to be processed against the underlying MySQL database. The parameter value flows into query execution without input validation or parameterized statements.

Because the vulnerable endpoint is reachable over the network and requires no authentication or user interaction, an attacker can craft HTTP requests that append or replace SQL syntax. The CVSS vector reflects impact limited to confidentiality, aligning with an information-disclosure primitive that reads database rows rather than modifies them.

The EPSS probability is 0.31%, indicating limited observed exploitation attempts at publication, though a public proof-of-concept is available on Gitee. See the Gitee PoC Repository for reproduction details.

Root Cause

The root cause is missing input sanitization on the sqlquery request parameter inside sys_sql_query.php. User-controlled input is concatenated into SQL statements executed by the CMS database layer. The component does not enforce authentication checks or apply prepared statements before dispatching the query.

Attack Vector

An attacker sends an HTTP request to the sys_sql_query.php endpoint with a malicious sqlquery value containing SQL operators such as UNION SELECT or boolean-based payloads. The server returns query results or observable timing and error differences, allowing extraction of arbitrary tables including administrator credential hashes and configuration data.

No verified exploitation code is reproduced here. Refer to the linked PoC repository for payload structure.

Detection Methods for CVE-2026-51077

Indicators of Compromise

HTTP requests to /plus/sys_sql_query.php or admin-path equivalents containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA in the sqlquery parameter.
Web server access logs showing repeated requests to sys_sql_query.php from a single source with varying sqlquery payloads.
Database query logs recording unexpected SELECT statements against dede_admin, dede_member, or other core tables from the web application user.

Detection Strategies

Deploy web application firewall signatures that flag SQL metacharacters and tautologies (' OR 1=1, --, /*) in the sqlquery parameter.
Alert on any HTTP request to sys_sql_query.php originating outside trusted administrator source IP ranges.
Correlate spikes in database query volume from the CMS service account with concurrent access to sys_sql_query.php.

Monitoring Recommendations

Enable verbose query logging on the MySQL backend and forward logs to a centralized analytics platform for retention and search.
Baseline normal administrative traffic to sys_sql_query.php and generate alerts for deviations in request rate or payload entropy.
Monitor outbound connections from the web server host for signs of exfiltration following suspicious query activity.

How to Mitigate CVE-2026-51077

Immediate Actions Required

Restrict network access to sys_sql_query.php using firewall or reverse-proxy allowlists limited to trusted administrator IP addresses.
Disable or remove the sys_sql_query.php component if the SQL console functionality is not required in production.
Rotate all administrator credentials and database user passwords in case prior exploitation extracted hashes.

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry. Consult the Dedecms Official Website for future security updates addressing CVE-2026-51077 and monitor the vendor advisory channels for a fixed release beyond 5.7.118.

Workarounds

Place the CMS administrative directory behind an authenticated reverse proxy that enforces multi-factor authentication before requests reach sys_sql_query.php.
Apply a WAF rule dropping requests where the sqlquery parameter contains SQL syntax tokens or exceeds a strict length threshold.
Configure the database account used by Dede CMS with least-privilege permissions, denying access to sensitive tables outside required schemas.

bash

# Example nginx location block restricting access to sys_sql_query.php
location ~* /sys_sql_query\.php$ {
    allow 10.0.0.0/24;   # trusted admin subnet
    deny all;
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}