CVE-2025-13171

Executive Summary

CVE-2025-13171 is a publicly disclosed SQL injection vulnerability affecting ZZCMS 2023. The flaw resides in the /admin/wangkan_list.php file, where the keyword argument is not properly sanitized before being used in a database query. This allows an unauthenticated remote attacker to inject arbitrary SQL commands, potentially leading to data exfiltration, modification, or authentication bypass. The CVSS score of 6.3 (Medium) reflects the ease of exploitation and potential for partial confidentiality, integrity, and availability impact. No official patch has been released, and the exploit is publicly available, making this a high-priority issue for any organization using ZZCMS 2023.

Supply Chain & Package Security

ZZCMS is a content management system (CMS) typically distributed as a PHP application. This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct code-level flaw in the CMS itself. Organizations should verify the integrity of their ZZCMS installation and consider it a supply chain risk if the software was obtained from unofficial sources.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited data modification possible.
• Availability (A): Low (L) – Limited service disruption possible.

Threat Level: Medium. The low attack complexity and public exploit availability increase the risk, but the impact is limited to partial data compromise.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the keyword parameter of the /admin/wangkan_list.php endpoint. The application likely constructs a SQL query by directly concatenating user input without proper sanitization or parameterized queries. For example, the vulnerable code might look like:

$keyword = $_GET['keyword'];
$sql = "SELECT * FROM wangkan WHERE name LIKE '%$keyword%'";
$result = mysqli_query($conn, $sql);

An attacker can inject SQL by providing a payload such as ' OR '1'='1 to bypass authentication or ' UNION SELECT ... to extract data from other tables. The admin prefix in the path suggests this is an administrative interface, but the lack of authentication checks makes it accessible to unauthenticated users.

Vulnerable vs. Patched Code

Vulnerable Code (ZZCMS 2023):

// /admin/wangkan_list.php
$keyword = $_GET['keyword'];
$sql = "SELECT * FROM wangkan WHERE name LIKE '%$keyword%'";
$result = mysqli_query($conn, $sql);

Patched Code (Hypothetical):

// /admin/wangkan_list.php
$keyword = mysqli_real_escape_string($conn, $_GET['keyword']);
$sql = "SELECT * FROM wangkan WHERE name LIKE '%$keyword%'";
$result = mysqli_query($conn, $sql);

Or better, using prepared statements:

$stmt = $conn->prepare("SELECT * FROM wangkan WHERE name LIKE ?");
$keyword = "%" . $_GET['keyword'] . "%";
$stmt->bind_param("s", $keyword);
$stmt->execute();
$result = $stmt->get_result();

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A target running ZZCMS 2023 with the /admin/wangkan_list.php endpoint accessible.
• Basic understanding of SQL injection techniques.

Exploit Steps:

1. Identify the vulnerable parameter: keyword.
2. Craft a payload to test for injection: ' OR '1'='1.
3. Use a UNION-based injection to extract data, e.g., ' UNION SELECT 1,2,3,4,5-- -.
4. Automate with a tool like sqlmap:

   sqlmap -u "http://target.com/admin/wangkan_list.php?keyword=test" --batch --dbs
   

Example Payload:

http://target.com/admin/wangkan_list.php?keyword=' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -

Blue Team (Defender)

Detection:

• Monitor web server logs for unusual SQL characters in the keyword parameter (e.g., ', --, UNION, SELECT).
• Use a Web Application Firewall (WAF) to block common SQL injection patterns.
• Implement input validation and parameterized queries.

Lab Setup:

• Deploy a vulnerable ZZCMS 2023 instance in an isolated environment.
• Use a tool like Burp Suite to replay and analyze requests.
• Set up logging and alerting for suspicious activity.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /admin/wangkan_list.php with keyword parameter containing SQL metacharacters (', ", --, #, UNION, SELECT).
  • Unusual response sizes or error messages containing SQL syntax errors.

• File IOCs:

  • Modified database entries in the wangkan table.
  • New files in the web root (e.g., webshells) if the injection leads to file write.

• Log IOCs:

  • Web server logs showing repeated requests to /admin/wangkan_list.php with varying keyword values.
  • Database logs showing unexpected queries.

Detection Engineering

YARA Rule

rule CVE_2025_13171_SQLi_Keyword {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-13171 in ZZCMS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13171"
    strings:
        $sqli_pattern1 = /keyword=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i
        $sqli_pattern2 = /keyword=.*\b(1=1|1=2|'='|admin'--)\b/i
    condition:
        any of them
}

Sigma Rule

title: SQL Injection Attempt on ZZCMS wangkan_list.php
id: 8a3b2c1d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts targeting the keyword parameter in ZZCMS /admin/wangkan_list.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains: 
            - "keyword='"
            - "keyword=%27"
            - "keyword=1' OR"
            - "keyword=1' AND"
            - "keyword=' UNION"
            - "keyword='--"
    condition: selection
falsepositives:
    - Legitimate use of apostrophes in search terms (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-13171 SQL Injection Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/admin/wangkan_list.php"; http_uri; content:"keyword="; http_uri; pcre:"/keyword=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable or restrict access to /admin/wangkan_list.php until a patch is applied.
   • Implement a Web Application Firewall (WAF) rule to block SQL injection patterns.
   • Review and sanitize all user inputs in the application.

2. Long-term Fix:

   • Apply parameterized queries (prepared statements) in all database interactions.
   • Update to a patched version of ZZCMS if/when available.
   • Conduct a full security audit of the codebase.

3. Monitoring:

   • Enable detailed logging for all admin endpoints.
   • Set up alerts for SQL injection attempts using the provided detection rules.

4. User Education:

   • Inform administrators about the risks of using outdated software.
   • Encourage the use of strong, unique passwords and multi-factor authentication.

Valters IT