CVE-2025-29390

Executive Summary

CVE-2025-29390 identifies a critical SQL Injection vulnerability in the set_password function of jerryhanjj ERP 1.0, located in application/controllers/home.php. This flaw allows an unauthenticated attacker to inject arbitrary SQL commands, potentially leading to full database compromise, credential theft, and lateral movement within the network. The vulnerability is publicly known with proof-of-concept details available, yet no official patch has been released. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains high due to the lack of remediation.

Supply Chain & Package Security

This vulnerability is not associated with NPM, PyPI, Go, or Ruby packages. It is a standalone PHP application (jerryhanjj ERP 1.0) and should be treated as a custom web application risk.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector provided; estimated high severity based on impact)
• Attack Vector: Network (unauthenticated)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High
• Threat Level: Critical (estimated)

Deep Dive & Mechanics

The vulnerability resides in the set_password function within application/controllers/home.php. The function likely accepts user-supplied input (e.g., username, token, or password) and directly concatenates it into a SQL query without proper sanitization or parameterized statements. An attacker can craft a malicious payload that breaks out of the intended SQL syntax, enabling data exfiltration, modification, or deletion.

Example vulnerable code pattern:

$sql = "UPDATE users SET password = '" . $_POST['new_password'] . "' WHERE username = '" . $_POST['username'] . "'";
$db->query($sql);

An attacker could inject:

username: admin' OR '1'='1
new_password: newpass

Resulting query:

UPDATE users SET password = 'newpass' WHERE username = 'admin' OR '1'='1'

This would update the password for all users, granting the attacker administrative access.

Vulnerable vs. Patched Code

Vulnerable code (jerryhanjj ERP 1.0):

// application/controllers/home.php
public function set_password() {
    $username = $_POST['username'];
    $new_password = md5($_POST['new_password']);
    $sql = "UPDATE users SET password = '$new_password' WHERE username = '$username'";
    $this->db->query($sql);
}

Patched code (recommended):

public function set_password() {
    $username = $this->db->escape($_POST['username']);
    $new_password = md5($_POST['new_password']);
    $sql = "UPDATE users SET password = '$new_password' WHERE username = '$username'";
    $this->db->query($sql);
}

Or better, using prepared statements:

public function set_password() {
    $stmt = $this->db->prepare("UPDATE users SET password = ? WHERE username = ?");
    $stmt->bind_param("ss", md5($_POST['new_password']), $_POST['username']);
    $stmt->execute();
}

Exploitation & Lab Setup

Red Team

1. Reconnaissance: Identify instances of jerryhanjj ERP 1.0 via Shodan dorks or web crawling.
2. Exploit: Send a crafted POST request to /home/set_password with SQL injection payload.

   curl -X POST http://target.com/home/set_password \
     -d "username=admin' OR '1'='1' -- -&new_password=attackerpass"
   

3. Post-exploitation: Login as admin, extract database credentials, pivot to internal systems.

Blue Team

1. Detection: Monitor for unusual POST requests to /home/set_password containing SQL keywords (OR, UNION, SELECT).
2. Honeypot: Deploy a fake ERP instance to capture attacker payloads.
3. Blocking: Use WAF rules to block SQL injection patterns.

Indicators of Compromise (IOCs)

• Network: POST requests to /home/set_password with SQL-like payloads.
• Logs: Database error logs showing syntax errors near user input.
• File: Modified application/controllers/home.php (if attacker patches).
• User: New or modified user accounts with elevated privileges.

Detection Engineering

YARA Rule

rule CVE_2025_29390_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting jerryhanjj ERP set_password function"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $s1 = "set_password" nocase
        $s2 = "OR" nocase
        $s3 = "UNION" nocase
        $s4 = "SELECT" nocase
    condition:
        all of ($s1, $s2) or all of ($s1, $s3) or all of ($s1, $s4)
}

Sigma Rule

title: SQL Injection Attempt Against jerryhanjj ERP set_password
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection patterns in POST requests to /home/set_password
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/home/set_password'
        cs-uri-query|contains: 
            - 'OR'
            - 'UNION'
            - 'SELECT'
    condition: selection
falsepositives:
    - Legitimate use of these words in passwords (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-29390 SQL Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/home/set_password"; http_uri; content:"OR"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Apply input validation and parameterized queries to the set_password function.
2. Network: Deploy a WAF with SQL injection rules.
3. Monitoring: Enable detailed logging for all POST requests to sensitive endpoints.
4. Patch: Since no official patch exists, consider migrating to a supported ERP solution.
5. Access Control: Restrict access to the ERP interface via VPN or IP whitelisting.

Valters IT
Securing Digital Frontiers