CVE-2026-10606: DedeCMS Feedback feedback.php TrimMsg sql injection
A vulnerability was determined in DedeCMS 5.7.88. The affected element is the function TrimMsg of the file /plus/feedback.php of the component Feedback Handler. Executing a manipulation of the argument msg can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
DedeCMS Feedback Handler (/plus/feedback.php)from your environment.If the feedback feature is not required, disable or remove the Feedback Handler by deleting or renaming /plus/feedback.php to prevent remote exploitation.
- Configuration
If running DedeCMS 5.7.88, modify the TrimMsg function in /plus/feedback.php to validate and sanitize the 'msg' parameter and use parameterized (prepared) statements or an equivalent safe DB API to eliminate SQL injection vectors.
DedeCMS /plus/feedback.php TrimMsg msg input handling = validate_and_parameterize - Compensating control
Block or restrict access to /plus/feedback.php using a web application firewall, network firewall, or access control rules; implement WAF rules to detect and block SQL injection payloads targeting the 'msg' parameter.
- Operational
Monitor and audit web and database logs for signs of exploitation of the TrimMsg/sql injection (especially if running DedeCMS 5.7.88); if compromise is suspected, perform incident response actions such as isolating affected hosts and rotating any credentials that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10606?
CVE-2026-10606 has a high severity rating of 7.3.
How do I fix CVE-2026-10606?
To fix CVE-2026-10606, update DedeCMS to the latest version that addresses this SQL injection vulnerability.
What type of vulnerability is CVE-2026-10606?
CVE-2026-10606 is an SQL injection vulnerability found in the TrimMsg function of the Feedback Handler in DedeCMS.
Can CVE-2026-10606 be exploited remotely?
Yes, CVE-2026-10606 can be exploited remotely by manipulating the msg argument.
Which version of DedeCMS is affected by CVE-2026-10606?
DedeCMS version 5.7.88 is affected by CVE-2026-10606.