CVE-2018-25319

Executive Summary

CVE-2018-25319 is a critical SQL injection vulnerability discovered in the Redaxo CMS addon MyEvents version 2.2.1. An authenticated attacker can inject arbitrary SQL commands through the myevents_id GET parameter on the event_add.php page. This allows extraction of the entire database, including user credentials and session tokens, as well as modification of data. The vulnerability has a CVSS score of 7.1 (High) and remains unpatched as of the latest advisory. No public exploit code or Nuclei template has been released, but the attack vector is straightforward and well-documented.

Supply Chain & Package Security

This vulnerability affects a third-party addon (MyEvents) for the Redaxo CMS. Redaxo itself is not directly vulnerable, but the addon introduces the risk. Since no official patch exists, users must either remove the addon or implement strict input validation and parameterized queries manually.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs a valid CMS account.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Exploit stays within the vulnerable component.
• Confidentiality (C): High (H) – Full database read access.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): None (N) – No direct DoS impact.

Threat Level: High – Exploitation is trivial for any authenticated user, and the impact on data confidentiality and integrity is severe.

Deep Dive & Mechanics

The vulnerability resides in the event_add.php script of the MyEvents addon. The myevents_id parameter is taken directly from the GET request and concatenated into an SQL query without sanitization or parameterization.

Vulnerable Code Snippet (Conceptual):

$id = $_GET['myevents_id'];
$query = "SELECT * FROM rex_myevents_events WHERE id = $id";
$result = mysql_query($query);

An attacker can inject SQL by providing a value like:

1 UNION SELECT username, password FROM rex_user

This results in the query:

SELECT * FROM rex_myevents_events WHERE id = 1 UNION SELECT username, password FROM rex_user

The database returns the union of the original result and the attacker's injected query, exposing sensitive data.

Vulnerable vs. Patched Code

Vulnerable (MyEvents 2.2.1):

$id = $_GET['myevents_id'];
$query = "SELECT * FROM rex_myevents_events WHERE id = $id";
$result = mysql_query($query);

Patched (Hypothetical fix):

$id = intval($_GET['myevents_id']);
$query = "SELECT * FROM rex_myevents_events WHERE id = $id";
$result = mysql_query($query);

Or using prepared statements:

$stmt = $pdo->prepare("SELECT * FROM rex_myevents_events WHERE id = :id");
$stmt->execute([':id' => $_GET['myevents_id']]);

Exploitation & Lab Setup

Red Team (Attack Simulation)

Lab Setup:

1. Install Redaxo CMS (any version) and the MyEvents addon 2.2.1.
2. Create an authenticated user account.
3. Access the vulnerable page: http://target/redaxo/index.php?page=myevents/event_add&myevents_id=1

Exploitation Steps:

1. Basic injection test: http://target/redaxo/index.php?page=myevents/event_add&myevents_id=1' – Look for SQL error messages.
2. Extract database version: http://target/redaxo/index.php?page=myevents/event_add&myevents_id=1 UNION SELECT @@version,2,3
3. Extract user credentials: http://target/redaxo/index.php?page=myevents/event_add&myevents_id=1 UNION SELECT name,password,3 FROM rex_user

Example Payload (URL-encoded):

http://target/redaxo/index.php?page=myevents/event_add&myevents_id=1%20UNION%20SELECT%20name%2Cpassword%2C3%20FROM%20rex_user

Blue Team (Defense & Detection)

Detection:

• Monitor web server logs for requests to event_add.php with suspicious myevents_id values containing SQL keywords (UNION, SELECT, FROM, etc.).
• Use WAF rules to block SQL injection patterns in GET parameters.

Mitigation:

• Immediately disable or remove the MyEvents addon if not critical.
• Implement input validation: ensure myevents_id is an integer.
• Use parameterized queries in any custom code.

Indicators of Compromise (IOCs)

• Network: HTTP GET requests to /redaxo/index.php?page=myevents/event_add with myevents_id containing SQL syntax.
• Logs: SQL error messages in application logs (e.g., "You have an error in your SQL syntax").
• Database: Unexpected entries in rex_myevents_events or rex_user tables.
• File: Modified event_add.php file (if attacker uploads a webshell).

Detection Engineering

YARA Rule

rule CVE_2018_25319_SQLi_MyEvents {
    meta:
        description = "Detects SQL injection attempts against MyEvents addon"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2018-25319"
    strings:
        $s1 = "myevents_id" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "FROM" nocase
        $s5 = "event_add.php" nocase
    condition:
        all of ($s1, $s5) and any of ($s2, $s3, $s4)
}

Sigma Rule

title: SQL Injection Attempt Against MyEvents Addon
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts via myevents_id parameter in event_add.php
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2018-25319
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 
            - "myevents_id="
            - "UNION"
            - "SELECT"
            - "FROM"
    condition: selection
falsepositives:
    - Legitimate use of the word "union" in a non-SQL context (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2018-25319 SQL Injection Attempt - MyEvents addon";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"event_add.php"; http_uri;
    content:"myevents_id"; http_uri;
    pcre:"/myevents_id=.*(UNION|SELECT|FROM|DROP|INSERT|UPDATE|DELETE)/Ui";
    sid:1000001;
    rev:1;
    reference:cve,2018-25319;
    classtype:web-application-attack;
)

Remediation & Mitigation

1. Immediate: Disable or uninstall the MyEvents addon (version 2.2.1) from all Redaxo installations.
2. Short-term: If the addon is critical, implement a WAF rule to block SQL injection patterns in the myevents_id parameter.
3. Long-term: Replace the addon with a maintained alternative or develop a custom solution using parameterized queries.
4. Monitoring: Enable detailed logging for all requests to event_add.php and review logs for suspicious activity.
5. User education: Ensure all CMS users have strong, unique passwords and limit privileges to the minimum required.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert