DedeCMS SQL Injection Vulnerability in Car Buy Action Component

A SQL injection vulnerability has been identified in DedeCMS version 5.7.88. The issue arises in the RemoveXSS function within the file plus/carbuyaction.php. The vulnerability can be exploited remotely by manipulating the postname or des arguments. This flaw allows for unauthorized SQL code execution, potentially leading to database manipulation or data exposure.

Impact

Exploitation of this vulnerability allows for SQL injection, enabling attackers to interfere with the application's database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.