A flaw in DedeCMS 5.7.88’s dede_htmlspecialchars function within the /plus/flink.php file allows an attacker to manipulate the msg argument and inject arbitrary SQL statements. The injection can be executed from a remote source, potentially granting the attacker the ability to read, modify, or delete database contents, thereby compromising data confidentiality and integrity.

All hosts running DedeCMS 5.7.88 are vulnerable. This includes installations that expose the /plus/flink.php endpoint, which is reachable by unauthenticated external users.

The vulnerability carries a CVSS score of 6.9, indicating a moderate to high severity. Although no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, the public release of an exploit and the remote nature of the attack vector elevate the risk for exposed systems. An attacker who can reach the vulnerable endpoint can inject SQL and extract or alter data without requiring authentication.