A critical SQL injection vulnerability in DedeCMS version 5.7.118 permits unauthenticated attackers to exfiltrate sensitive database information.

This is a SQL injection flaw located in the sys_sql_query.php component: specifically, the application fails to sanitize input provided to the sqlquery parameter. Because the vulnerability is reachable without authentication, any remote attacker can execute arbitrary database queries.

The ability for an unauthenticated attacker to perform arbitrary SQL queries presents a severe risk of unauthorized data disclosure, potentially leading to the compromise of user credentials, personal information, or proprietary business data. With a CVSS score of 7.5, this vulnerability is classified as high severity, and it poses a significant threat to the confidentiality of the entire backend database.

Immediate Action: Since no official patch is confirmed, administrators should immediately restrict access to the sys_sql_query.php file or disable the affected module if it is not business critical.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns targeted at the sys_sql_query.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule specifically designed to block or sanitize input containing common SQL injection payloads directed at the vulnerable file.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub repository.

Given the availability of a public proof-of-concept and the ease of exploitation over the network, organizations using DedeCMS 5.7.118 must treat this as a high priority. Implement the suggested compensating controls immediately and monitor vendor channels for the release of a security patch to fully remediate the underlying flaw.