CVE-2025-14185

Executive Summary

CVE-2025-14185 is a critical SQL injection vulnerability affecting Yonyou U8 Cloud versions 5.0, 5.0sp, 5.1, and 5.1sp. The flaw resides in the nc/pubitf/erm/mobile/appservice/AppServletService.class file, where the usercode parameter is improperly sanitized, allowing remote attackers to inject arbitrary SQL commands. With a CVSS score of 6.3 (Medium), the vulnerability is remotely exploitable without authentication, and a public exploit is available. The vendor has not responded to disclosure attempts, leaving users at risk. This report provides a comprehensive technical analysis, detection rules, and mitigation strategies.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Base Score: 6.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

The threat level is elevated due to the availability of a public exploit and the lack of a vendor patch. While the CVSS score is medium, the potential for data exfiltration and lateral movement makes this a high-priority issue for affected organizations.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the AppServletService.class servlet. The usercode parameter is passed directly into a SQL query without proper sanitization or parameterization. An attacker can craft a malicious HTTP request to the vulnerable endpoint, injecting SQL commands that can extract, modify, or delete database contents.

The affected file is part of the Yonyou U8 Cloud ERP system, which handles sensitive business data. The injection point is in the mobile app service, making it accessible via web requests. The exploit is publicly available, meaning attackers can easily weaponize this flaw.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be:

// Vulnerable code (conceptual)
String usercode = request.getParameter("usercode");
String query = "SELECT * FROM users WHERE usercode = '" + usercode + "'";
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(query);

A patched version would use parameterized queries:

// Patched code (conceptual)
String usercode = request.getParameter("usercode");
String query = "SELECT * FROM users WHERE usercode = ?";
PreparedStatement pstmt = connection.prepareStatement(query);
pstmt.setString(1, usercode);
ResultSet rs = pstmt.executeQuery();

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Setup: Deploy a vulnerable Yonyou U8 Cloud instance (version 5.0-5.1sp) in an isolated lab environment.
2. Reconnaissance: Identify the vulnerable endpoint using Shodan dorks or manual discovery (e.g., /nc/pubitf/erm/mobile/appservice/AppServletService).
3. Exploitation: Use a tool like sqlmap or a custom script to inject SQL commands via the usercode parameter.

Example exploit payload (URL-encoded):

POST /nc/pubitf/erm/mobile/appservice/AppServletService HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

usercode=admin' OR '1'='1' -- 

This payload bypasses authentication and returns all records from the users table.

Blue Team (Defense & Detection)

1. Monitor: Watch for anomalous SQL queries in database logs.
2. Harden: Implement a Web Application Firewall (WAF) with rules to block SQL injection patterns.
3. Isolate: If possible, restrict network access to the vulnerable servlet until a patch is applied.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /nc/pubitf/erm/mobile/appservice/AppServletService with unusual usercode parameters (e.g., containing SQL keywords like OR, AND, UNION, --).
• Logs: Database logs showing unexpected queries with injected SQL syntax.
• File: Presence of suspicious files in the application directory (e.g., webshells uploaded via SQL injection).

Detection Engineering

YARA Rule

rule CVE_2025_14185_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting Yonyou U8 Cloud AppServletService"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-14185"
    strings:
        $s1 = "AppServletService" ascii wide nocase
        $s2 = "usercode" ascii wide nocase
        $sqli1 = /usercode=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/ nocase
    condition:
        $s1 and $s2 and $sqli1
}

Sigma Rule

title: SQL Injection Attempt Against Yonyou U8 Cloud AppServletService
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts in HTTP requests to the vulnerable endpoint
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-14185
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-path: "/nc/pubitf/erm/mobile/appservice/AppServletService"
        cs-uri-query|contains: "usercode="
    keywords:
        - "OR"
        - "AND"
        - "UNION"
        - "SELECT"
        - "INSERT"
        - "UPDATE"
        - "DELETE"
        - "DROP"
        - "--"
        - "#"
    condition: selection and keywords
falsepositives:
    - Legitimate use of SQL keywords in usercode (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-14185 SQL Injection Attempt"; flow:to_server,established; content:"/nc/pubitf/erm/mobile/appservice/AppServletService"; http_uri; content:"usercode="; http_uri; pcre:"/usercode=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Apply a virtual patch using a WAF to block SQL injection patterns targeting the usercode parameter.
• Short-term: If possible, disable the vulnerable servlet or restrict access to trusted IPs only.
• Long-term: Contact Yonyou for an official patch. If none is forthcoming, consider migrating to a supported version or alternative ERP solution.
• Compensating Controls: Implement strict input validation and parameterized queries in any custom code interacting with the database.

Valters IT