SQL injection vulnerability in Dede CMS version 5.7.118 allows a remote attacker to execute arbitrary SQL through the sqlquery parameter in the sys_sql_query.php component. The flaw can lead to disclosure of sensitive database contents, including user credentials, configuration details, or other confidential data. This is a classic input‑validation weakness described by CWE‑89, compromising application confidentiality.

The vulnerability exists in Dede CMS version 5.7.118. The impacted component is sys_sql_query.php. No other versions are mentioned in the available information.

The attack can be performed remotely by sending a crafted HTTP request with a malicious sqlquery value to the sys_sql_query.php endpoint. The EPSS score of <1% shows a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that successful exploitation requires the PHP code to have database access permissions; if such permissions are absent, the attack would fail. Administrators should understand that an attacker could retrieve arbitrary data from the underlying MySQL database if sufficient privileges are granted to the application.