CVE-2025-25590

Executive Summary

CVE-2025-25590 is a critical SQL injection vulnerability discovered in the Yimioa application, affecting versions prior to the 2024.07.04 release. The flaw resides in the /mapper/xml/AddressDao.xml component, allowing an unauthenticated attacker to inject arbitrary SQL commands. Successful exploitation could lead to unauthorized data access, data exfiltration, or complete database compromise. The vulnerability is publicly known, and while no official patch details are available, upgrading to version 2024.07.04 or later is recommended.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It is a standalone Java/Spring application vulnerability.

CVSS Breakdown & Threat Level

While the official CVSS score is listed as 0.0, based on the nature of the vulnerability (SQL injection in a mapper XML file), the following vector is estimated:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full database read access is possible.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Database can be disrupted or destroyed.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Estimated Base Score: 9.8 (Critical)

Deep Dive & Mechanics

The vulnerability is located in the AddressDao.xml file, which is a MyBatis mapper XML. MyBatis is a SQL mapping framework that uses XML or annotations to map Java objects to SQL statements. The flaw likely stems from the use of string concatenation or ${} (substitution) instead of #{} (parameterized) syntax in the SQL queries.

Vulnerable Code Pattern:

<select id="getAddress" parameterType="String" resultType="Address">
    SELECT * FROM address WHERE id = ${id}
</select>

In this pattern, the ${id} is directly substituted into the SQL string, allowing an attacker to inject SQL commands. The correct, safe pattern uses #{} which prepares the statement and escapes input:

Patched Code Pattern:

<select id="getAddress" parameterType="String" resultType="Address">
    SELECT * FROM address WHERE id = #{id}
</select>

The vulnerability is triggered by sending a crafted HTTP request to an endpoint that invokes the vulnerable mapper method. The exact endpoint is not publicly documented, but typical patterns include /api/address, /address/get, or similar RESTful endpoints.

Vulnerable vs. Patched Code

Vulnerable (Pre-2024.07.04):

<!-- AddressDao.xml -->
<mapper namespace="com.yimioa.dao.AddressDao">
    <select id="getAddressById" parameterType="String" resultType="Address">
        SELECT * FROM address WHERE id = ${id}
    </select>
</mapper>

Patched (2024.07.04+):

<!-- AddressDao.xml -->
<mapper namespace="com.yimioa.dao.AddressDao">
    <select id="getAddressById" parameterType="String" resultType="Address">
        SELECT * FROM address WHERE id = #{id}
    </select>
</mapper>

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable instance of Yimioa (version < 2024.07.04)
• Network access to the application
• Knowledge of the vulnerable endpoint (e.g., /api/address/get)

Exploitation Steps:

1. Identify the vulnerable endpoint: Use a web crawler or manual inspection to find endpoints that interact with the AddressDao. Common patterns include:

   • /api/address
   • /address/get
   • /address/find

2. Craft a malicious payload: Since the vulnerability is in a ${} substitution, inject SQL directly. For example, to extract the database version:

   GET /api/address/get?id=1 UNION SELECT @@version,2,3
   

3. Automated exploitation with SQLMap:

   sqlmap -u "http://target.com/api/address/get?id=1" --batch --dbs
   

4. Manual exploitation example:

   curl "http://target.com/api/address/get?id=1' UNION SELECT 1,2,3--"
   

Expected Output: The application will return the results of the injected SQL query, potentially exposing sensitive data.

Blue Team

Detection and Response:

1. Monitor for SQL injection patterns:

   • Look for requests containing SQL keywords (UNION, SELECT, OR 1=1, etc.) in URL parameters.
   • Monitor for unusual response sizes or error messages containing SQL syntax.

2. Web Application Firewall (WAF) Rules:

   • Block requests with suspicious SQL patterns in the id parameter.
   • Implement rate limiting on API endpoints.

3. Log Analysis:

   • Check application logs for SQL errors or exceptions.
   • Correlate with network logs for suspicious IP addresses.

4. Immediate Actions:

   • Isolate the vulnerable application.
   • Apply the patch (upgrade to 2024.07.04 or later).
   • Review database logs for unauthorized queries.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /api/address/get or similar endpoints with SQL keywords in the id parameter.
• Unusually large response bodies from the address endpoint.
• SQL error messages in HTTP responses (e.g., "You have an error in your SQL syntax").

File IOCs:

• Modified AddressDao.xml files (if attacker gained write access).
• Suspicious log entries in application logs.

System IOCs:

• Unexpected database connections from the application server.
• New user accounts or privileges in the database.

Detection Engineering

YARA Rule

rule CVE_2025_25590_Yimioa_SQLi {
    meta:
        description = "Detects Yimioa AddressDao.xml files with SQL injection vulnerability"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-25590"
    strings:
        $s1 = "AddressDao.xml"
        $s2 = "\${" nocase
        $s3 = "select" nocase
        $s4 = "from" nocase
        $s5 = "where" nocase
    condition:
        all of ($s1,$s2) and 2 of ($s3,$s4,$s5)
}

Sigma Rule

title: CVE-2025-25590 - Yimioa SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting Yimioa AddressDao endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'id='
            - 'UNION'
            - 'SELECT'
            - 'OR 1=1'
            - '--'
    condition: selection
falsepositives:
    - Legitimate use of SQL keywords in parameters (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-25590 - Yimioa SQL Injection Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/api/address/get"; http_uri;
    content:"id="; http_uri;
    pcre:"/(UNION|SELECT|OR\s+1=1|--)/Ui";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Yimioa: Update to version 2024.07.04 or later.
2. Apply Virtual Patching: If immediate upgrade is not possible, deploy a WAF rule to block SQL injection patterns.
3. Database Hardening: Ensure the database user used by the application has minimal privileges (e.g., no DROP, CREATE, or GRANT permissions).

Long-term Measures:

1. Code Review: Audit all MyBatis mapper XML files for ${} usage and replace with #{}.
2. Input Validation: Implement strict input validation and sanitization for all user-supplied data.
3. Security Testing: Integrate SAST/DAST tools into the CI/CD pipeline to detect SQL injection vulnerabilities.
4. Monitoring: Enable detailed logging and monitoring for all database queries.

Verification:

• After patching, test the endpoint with SQL injection payloads to confirm they are blocked.
• Review application logs for any signs of previous exploitation.

Report generated by Valters IT DevSecOps & CTI Framework