CVE-2025-14664

Executive Summary

CVE-2025-14664 is a critical SQL injection vulnerability discovered in Campcodes Supplier Management System version 1.0. The flaw resides in the /admin/view_unit.php file, where the chkId[] parameter is improperly sanitized before being used in a database query. An unauthenticated remote attacker can exploit this by sending a crafted HTTP POST request, leading to arbitrary SQL execution. This can result in full database compromise, including extraction of sensitive supplier data, credentials, and potential lateral movement within the network. The exploit is publicly available, and no official patch has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the public availability of the exploit increases the risk.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a standalone PHP application.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full database read access.
• Integrity Impact: High (I:H) – Data can be modified or deleted.
• Availability Impact: High (A:H) – Database can be disrupted or destroyed.

Threat Level: High. The combination of remote exploitability, no authentication, and high impact makes this a critical risk for any organization using this software.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the chkId[] parameter of /admin/view_unit.php. The application likely constructs a SQL query by directly concatenating user-supplied input from the chkId[] array without proper sanitization or parameterized queries.

Vulnerable Code Snippet (Hypothetical):

<?php
$ids = $_POST['chkId'];
if (!empty($ids)) {
    $id_list = implode(",", $ids);
    $query = "SELECT * FROM units WHERE id IN ($id_list)";
    $result = mysqli_query($conn, $query);
    // ...
}
?>

The implode function joins the array elements with commas, but does not escape them. An attacker can inject SQL by providing a value like 1) OR 1=1 -- -.

Attack Flow:

1. Attacker sends a POST request to /admin/view_unit.php with chkId[]=1) OR 1=1 -- -.
2. The PHP code builds the query: SELECT * FROM units WHERE id IN (1) OR 1=1 -- -).
3. The -- - comments out the rest of the query, making it always true.
4. The attacker can then extract data using UNION-based SQL injection.

Vulnerable vs. Patched Code

Vulnerable Code (Hypothetical):

$id_list = implode(",", $ids);
$query = "SELECT * FROM units WHERE id IN ($id_list)";

Patched Code (Hypothetical):

$safe_ids = array_map('intval', $ids);
$id_list = implode(",", $safe_ids);
$query = "SELECT * FROM units WHERE id IN ($id_list)";

The patch uses intval() to cast each element to an integer, effectively neutralizing any SQL injection attempt. Since no official patch exists, users must implement this fix manually.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running Campcodes Supplier Management System 1.0.
• Network access to the /admin/view_unit.php endpoint.

Exploit Steps:

1. Identify the vulnerable endpoint: Send a POST request with a test payload.
2. Craft the injection: Use a UNION-based SQL injection to extract data.

Example Exploit (using curl):

curl -X POST "http://target.com/admin/view_unit.php" \
  -d "chkId[]=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -"

Manual Exploitation:

• Use a tool like sqlmap for automated exploitation:

sqlmap -u "http://target.com/admin/view_unit.php" \
  --data="chkId[]=1" --batch --dbs

Expected Output:

• Database names, tables, and sensitive data (e.g., admin credentials, supplier information).

Blue Team (Detection & Response)

Detection Steps:

1. Monitor HTTP POST requests to /admin/view_unit.php with unusual chkId[] values.
2. Look for SQL keywords in the parameter (e.g., UNION, SELECT, OR, --).
3. Check database logs for unexpected queries or errors.

Response Actions:

• Block the attacking IP immediately.
• Review database logs for data exfiltration.
• Apply the manual patch (cast to integer) to the vulnerable file.
• Restrict access to /admin/ directory via firewall or .htaccess.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /admin/view_unit.php with chkId[] containing SQL keywords.
  • Unusual database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
• File IOCs:
  • Modified /admin/view_unit.php file (if attacker uploaded a web shell).
  • Suspicious files in the web root (e.g., shell.php, cmd.php).
• Log IOCs:
  • Database logs showing queries with UNION, OR 1=1, or --.
  • Web server logs showing repeated POST requests to /admin/view_unit.php.

Detection Engineering

YARA Rule

rule CVE_2025_14664_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-14664"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-14664"
    strings:
        $s1 = "chkId[]" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "OR" nocase
        $s5 = "--" nocase
    condition:
        all of ($s1, $s2, $s3, $s4, $s5)
}

Sigma Rule

title: SQL Injection Attempt Against CVE-2025-14664
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting /admin/view_unit.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/view_unit.php'
        cs-uri-query|contains: 'chkId[]'
    keywords:
        - 'UNION'
        - 'SELECT'
        - 'OR'
        - '--'
    condition: selection and keywords
falsepositives:
    - Legitimate use of the parameter with numeric values only
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2025-14664 SQL Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/admin/view_unit.php";
    http_uri;
    content:"chkId[]";
    http_client_body;
    pcre:"/(UNION|SELECT|OR|--)/Ri";
    sid:1000001;
    rev:1;
    reference:cve,2025-14664;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Apply the manual patch: Modify /admin/view_unit.php to cast chkId[] values to integers.
2. Restrict access: Use .htaccess or firewall rules to limit access to /admin/ directory to trusted IPs only.
3. Monitor logs: Actively monitor web and database logs for exploitation attempts.

Long-term Recommendations:

• Upgrade: If a patched version becomes available, upgrade immediately.
• Code review: Conduct a full security audit of the application for similar vulnerabilities.
• WAF: Deploy a Web Application Firewall with SQL injection detection rules.
• Input validation: Implement strict input validation and parameterized queries across the entire application.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact threatintel@valters-it.com.