A critical SQL injection vulnerability has been discovered in DedeCMS version 5.7.88. The flaw affects the RemoveXSS function in the /plus/carbuyaction.php file, where manipulation of the postname/des arguments leads to SQL injection. The vulnerability can be exploited remotely and poses a significant security risk. Public exploits have been released, making this an actively exploitable threat. Organizations using DedeCMS should prioritize patching this vulnerability immediately.