CVE-2025-12861: DedeBIZ spec_add.php sql injection
A vulnerability was determined in DedeBIZ up to 6.3.2. Affected by this vulnerability is an unknown functionality of the file /admin/specadd.php. This manipulation of the argument flags[] causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12861?
The severity of CVE-2025-12861 is currently classified as high due to the potential for remote SQL injection.
How do I fix CVE-2025-12861?
To fix CVE-2025-12861, it is recommended to update DedeBIZ to version 6.3.3 or later, which addresses the vulnerability.
What is impacted by CVE-2025-12861?
CVE-2025-12861 impacts DedeBIZ versions up to and including 6.3.2, specifically through the /admin/spec_add.php file.
How can CVE-2025-12861 be exploited?
CVE-2025-12861 can be exploited remotely by manipulating the 'flags[]' argument to perform SQL injection.
Is CVE-2025-12861 a known issue?
Yes, CVE-2025-12861 is a known issue affecting the DedeBIZ platform, and it has been assigned a vulnerability ID for tracking.