CVE-2025-1224

Executive Summary

CVE-2025-1224 is a critical SQL injection vulnerability discovered in the Ywoa application, affecting versions up to and including 2024.07.03. The flaw resides in the listNameBySql function within the com/cloudweb/oa/mapper/xml/UserMapper.xml file. An attacker can exploit this vulnerability remotely without authentication, leading to potential data exfiltration, modification, or complete compromise of the underlying database. The exploit has been publicly disclosed, increasing the risk of active exploitation. The vendor has released version 2024.07.04 to address the issue.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct application-level flaw in the Ywoa software. Organizations using Ywoa should treat this as a critical supply chain risk and prioritize patching.

CVSS Breakdown & Threat Level

While a CVSS vector is not provided, the vulnerability is classified as critical due to the following factors:

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – the vulnerable component remains the same.
• Confidentiality (C): High (H) – full database read access possible.
• Integrity (I): High (H) – data can be modified or deleted.
• Availability (A): High (H) – potential for denial of service via database corruption.

Threat Level: Critical. The combination of remote exploitability, no authentication, and public exploit code makes this a high-priority threat.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the listNameBySql function. This function likely constructs a SQL query by concatenating user-supplied input directly into the SQL statement without proper sanitization or parameterization. The function is defined in the MyBatis mapper file UserMapper.xml, which suggests the application uses MyBatis for database interactions.

Root Cause: The listNameBySql function takes a SQL string as a parameter and executes it directly. If an attacker can control the input to this function, they can inject arbitrary SQL commands.

Attack Vector: An attacker sends a crafted HTTP request to an endpoint that calls listNameBySql with malicious input. For example, a request parameter like sql=1' UNION SELECT username,password FROM users-- could be used to extract credentials.

Impact: Successful exploitation allows an attacker to:

• Read arbitrary data from the database (e.g., user credentials, sensitive business data).
• Modify or delete data (e.g., change user roles, delete records).
• Potentially execute operating system commands if the database user has sufficient privileges (e.g., xp_cmdshell in SQL Server).

Vulnerable vs. Patched Code

Vulnerable Code (<= 2024.07.03): The vulnerable code in UserMapper.xml likely looks like this:

<select id="listNameBySql" parameterType="string" resultType="map">
    SELECT * FROM users WHERE name = '${value}'
</select>

The use of ${value} (string substitution) instead of #{value} (parameterized) allows SQL injection.

Patched Code (>= 2024.07.04): The patched version should use parameterized queries:

<select id="listNameBySql" parameterType="string" resultType="map">
    SELECT * FROM users WHERE name = #{value}
</select>

This change ensures that user input is treated as a parameter, not executable SQL.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable instance of Ywoa (version <= 2024.07.03).
• A tool like sqlmap or curl for manual exploitation.

Exploitation Steps:

1. Identify an endpoint that uses the listNameBySql function. This could be a search or filter feature.
2. Inject a SQL payload. For example, if the vulnerable parameter is name, send:

   GET /api/users?name=1' OR '1'='1
   

3. Use sqlmap for automated exploitation:

   sqlmap -u "http://target.com/api/users?name=1" --batch --dbs
   

Example Payload:

1' UNION SELECT null,username,password,null FROM users--

Blue Team (Defensive)

Detection:

• Monitor for SQL injection patterns in web logs (e.g., ' OR, UNION SELECT, --).
• Use a Web Application Firewall (WAF) to block malicious SQL keywords.

Hunting:

• Search for requests to endpoints that call listNameBySql with suspicious parameters.
• Analyze database logs for unexpected queries.

Lab Setup:

• Deploy a vulnerable Ywoa instance in an isolated environment.
• Use tools like Burp Suite to intercept and modify requests.
• Simulate attacks to test detection rules.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing SQL injection patterns (e.g., ' OR, UNION, --).
  • Unusual database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
• Host IOCs:
  • Unexpected database queries in logs (e.g., SELECT * FROM users).
  • New user accounts or modified permissions in the database.
• File IOCs:
  • Modified UserMapper.xml file (if attacker attempts to patch).
  • Presence of webshells or backdoors in the web root.

Detection Engineering

YARA Rule

rule CVE_2025_1224_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting Ywoa listNameBySql"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-1224"
    strings:
        $s1 = "listNameBySql" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "' OR" nocase
        $s5 = "1=1" nocase
    condition:
        any of ($s1) and (any of ($s2,$s3,$s4,$s5))
}

Sigma Rule

title: CVE-2025-1224 SQL Injection Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts against Ywoa listNameBySql function
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'listNameBySql'
            - 'UNION'
            - 'SELECT'
            - "' OR"
            - '1=1'
    condition: selection
falsepositives:
    - Legitimate use of SQL keywords in search queries (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-1224 SQL Injection Attempt"; flow:to_server,established; content:"listNameBySql"; http_uri; nocase; content:"UNION"; http_uri; nocase; content:"SELECT"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Ywoa to version 2024.07.04 or later.
2. Apply virtual patching using a WAF to block SQL injection patterns.
3. Restrict network access to the Ywoa application to trusted IPs only.

Long-term Measures:

• Code Review: Ensure all database queries use parameterized statements or prepared statements.
• Input Validation: Implement strict input validation and sanitization for all user-supplied data.
• Least Privilege: Ensure the database user used by the application has minimal necessary privileges.
• Monitoring: Enable detailed logging and alerting for SQL injection attempts.

Workaround: If immediate patching is not possible, disable the functionality that uses listNameBySql or implement a custom filter to block malicious input.

Valters IT
Securing Your Digital Frontier