CVE-2025-13811

Executive Summary

CVE-2025-13811 is a critical SQL injection vulnerability discovered in the Jsnjfz WebStack-Guns application, version 1.0. The flaw resides in the PageFactory.java file, specifically within the sort parameter handling. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands, potentially leading to data exfiltration, modification, or denial of service. The exploit has been publicly disclosed, and the vendor has not responded to disclosure attempts, leaving the software in an unpatched state. The CVSS score of 6.3 (Medium) reflects the ease of exploitation and potential for significant data impact.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct application-level flaw in a Java-based web application. No supply chain compromise is indicated.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality Impact (C): Low (L) – Limited data access possible.
• Integrity Impact (I): Low (L) – Limited data modification possible.
• Availability Impact (A): Low (L) – Limited service disruption possible.

Threat Level: Medium. The vulnerability is easy to exploit and publicly known, but the impact is limited to low-level data compromise. However, in a database with sensitive information, the actual risk could be higher.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the sort parameter of the PageFactory.java file. The application likely constructs a SQL query by concatenating user input directly into the ORDER BY clause without proper sanitization or parameterization. For example, a vulnerable code snippet might look like:

String query = "SELECT * FROM users ORDER BY " + sort;

An attacker can manipulate the sort parameter to break out of the intended SQL syntax and inject malicious commands. Since the ORDER BY clause is used, the injection typically requires a blind SQL injection technique (e.g., time-based or boolean-based) to extract data, as direct output may not be visible.

The exploit is publicly available, meaning attackers can easily replicate the attack. The lack of vendor response indicates that no patch will be forthcoming, making this a permanent risk for any instance running WebStack-Guns 1.0.

Vulnerable vs. Patched Code

Vulnerable Code (PageFactory.java):

public class PageFactory {
    public String buildSortQuery(String sort) {
        // Vulnerable: direct concatenation
        return "ORDER BY " + sort;
    }
}

Patched Code (Hypothetical):

public class PageFactory {
    public String buildSortQuery(String sort) {
        // Patched: whitelist allowed columns
        List<String> allowedSorts = Arrays.asList("id", "name", "date");
        if (!allowedSorts.contains(sort)) {
            sort = "id"; // default safe value
        }
        return "ORDER BY " + sort;
    }
}

The patched version uses a whitelist approach to ensure only predefined column names are accepted, preventing injection. Alternatively, parameterized queries could be used, but ORDER BY clauses cannot be parameterized directly, so whitelisting is the recommended mitigation.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy WebStack-Guns 1.0 in a controlled environment (e.g., Docker container).
2. Identify the vulnerable endpoint (likely a REST API or web page that accepts a sort parameter).
3. Use a tool like sqlmap or manual injection to exploit.

Exploit Example (Manual):

GET /api/users?sort=id%2C(SELECT%20CASE%20WHEN%20(1=1)%20THEN%20sleep(5)%20ELSE%20id%20END) HTTP/1.1
Host: target.com

This payload attempts a time-based blind injection. If the server delays by 5 seconds, the injection is successful.

Automated Exploit with sqlmap:

sqlmap -u "http://target.com/api/users?sort=id" --batch --dbs

Blue Team (Defensive)

Detection:

• Monitor for unusual sort parameter values containing SQL keywords (e.g., UNION, SELECT, SLEEP).
• Look for time-based anomalies in response times.
• Use WAF rules to block suspicious patterns.

Mitigation:

• Immediately apply input validation (whitelist) to the sort parameter.
• If possible, upgrade to a patched version or migrate away from WebStack-Guns.
• Implement a Web Application Firewall (WAF) with SQL injection rules.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with sort parameter containing SQL syntax (e.g., ', --, UNION, SLEEP).
  • Unusual response delays (time-based injection).
• File IOCs:
  • Log entries showing failed SQL queries in application logs.
• System IOCs:
  • Unexpected database connections or queries from the application server.

Detection Engineering

YARA Rule

rule CVE_2025_13811_SQLi_WebStackGuns {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-13811 in WebStack-Guns"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13811"
    strings:
        $sqli1 = /sort=.*['\"]/ nocase
        $sqli2 = /sort=.*UNION/i
        $sqli3 = /sort=.*SLEEP/i
        $sqli4 = /sort=.*--/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-13811 SQL Injection Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects SQL injection attempts against WebStack-Guns sort parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 
            - "sort="
        cs-uri-query|re: 
            - "['\"]"
            - "UNION"
            - "SLEEP"
            - "--"
    condition: selection
falsepositives:
    - Legitimate use of special characters in sort parameter (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-13811 SQL Injection Attempt"; flow:to_server; content:"sort="; nocase; pcre:"/sort=.*['\"]|sort=.*UNION|sort=.*SLEEP|sort=.*--/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Apply input validation to the sort parameter. Use a whitelist of allowed column names.
2. Short-term: Deploy a WAF with SQL injection rules to block malicious requests.
3. Long-term: Migrate away from WebStack-Guns to a supported and maintained alternative.
4. Monitoring: Enable detailed logging for all database queries and monitor for anomalies.
5. Vendor Contact: Continue attempts to contact the vendor for an official patch.

Since no patch is available, the only complete mitigation is to replace the software.

Valters IT