The flaw is a SQL injection in the RemoveXSS function of DedeCMS 5.7.88's /plus/carbuyaction.php, caused by unsanitized handling of the postname/des argument. This error arises from improper input validation (CWE-74) and allows an attacker to inject arbitrary SQL commands that are executed against the database, enabling read, modification, or deletion of sensitive data.

The vulnerability affects DedeCMS version 5.7.88, specifically the RemoveXSS routine in carbuyaction.php. No other versions or products are listed as affected.

With a CVSS score of 6.9 the risk is classified as medium. Attackers can reach the vulnerable endpoint remotely; exploit code has been publicly released, so exploitation probability is non‑zero. The vulnerability is not in the CISA KEV catalog but could be used by threat actors. The lack of EPSS data suggests no current widespread targeting, yet the presence of a public exploit means the risk remains moderate to high for unpatched installations.