CVE-2025-5386

Executive Summary

CVE-2025-5386 is a critical unauthenticated SQL injection vulnerability in JeeWMS, an open-source Warehouse Management System. The flaw resides in the /cgformTransController.do?transEditor endpoint, allowing remote attackers to inject arbitrary SQL commands without authentication. The vendor does not use versioning, making affected releases unclear, and no official patch has been released. Given the lack of patch and the critical nature of the vulnerability, immediate mitigation actions are required.

Supply Chain & Package Security

This vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in a standalone Java web application (JeeWMS). The risk is direct exploitation of the deployed application, not supply chain compromise.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is trivial to exploit remotely with no authentication, leading to full database compromise, data exfiltration, and potential server takeover.

Deep Dive & Mechanics

The vulnerability exists in the transEditor function of the cgformTransController.do servlet. The application fails to sanitize user-supplied input passed via the transEditor parameter. This input is directly concatenated into SQL queries, allowing an attacker to break out of the intended query structure and execute arbitrary SQL commands.

The attack is performed via HTTP GET or POST requests to the vulnerable endpoint. The injection point is likely in a WHERE clause or similar SQL construct. An attacker can use standard SQL injection techniques (e.g., ' OR '1'='1, UNION-based, or time-based blind) to extract data, modify records, or execute system commands if the database user has sufficient privileges.

Vulnerable vs. Patched Code

Since no official patch exists, the following is a hypothetical comparison based on secure coding practices.

Vulnerable Code (Conceptual Java Servlet):

String transEditor = request.getParameter("transEditor");
String query = "SELECT * FROM cgform_head WHERE id = '" + transEditor + "'";
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(query);

Patched Code (Conceptual):

String transEditor = request.getParameter("transEditor");
String query = "SELECT * FROM cgform_head WHERE id = ?";
PreparedStatement pstmt = connection.prepareStatement(query);
pstmt.setString(1, transEditor);
ResultSet rs = pstmt.executeQuery();

The patched version uses parameterized queries (PreparedStatement) to prevent SQL injection. Input validation and output encoding should also be applied.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running JeeWMS with the vulnerable endpoint accessible.
• No authentication required.

Exploitation Steps:

1. Identify the vulnerable endpoint: http://target/cgformTransController.do?transEditor=test
2. Confirm injection by sending a payload that causes a time delay or error:

   http://target/cgformTransController.do?transEditor=1' OR SLEEP(5)-- -
   

3. Extract database information using UNION-based injection:

   http://target/cgformTransController.do?transEditor=1' UNION SELECT 1,2,3,database(),5,6,7,8,9,10-- -
   

4. Enumerate tables and columns, then dump sensitive data.

Example Payload (URL-encoded):

/cgformTransController.do?transEditor=1'%20UNION%20SELECT%201,2,3,group_concat(table_name),5,6,7,8,9,10%20FROM%20information_schema.tables%20WHERE%20table_schema=database()--%20-

Blue Team

Detection:

• Monitor HTTP requests to /cgformTransController.do with unusual parameters (e.g., containing SQL keywords like UNION, SELECT, SLEEP, OR).
• Look for error messages in application logs indicating SQL syntax errors.
• Use WAF rules to block common SQL injection patterns.

Honeypot:

• Deploy a decoy JeeWMS instance to capture attacker behavior.

Forensic Analysis:

• Check database logs for unexpected queries.
• Review web server access logs for anomalous patterns.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /cgformTransController.do with transEditor parameter containing SQL metacharacters (', --, UNION, SLEEP).
  • Outbound database connections from the web server to unusual IPs (data exfiltration).
• Host:
  • Unexpected files in the web root (e.g., webshells).
  • New database users or modified privileges.
  • Unusual processes (e.g., nc, bash reverse shells).
• Logs:
  • SQL errors in application logs (e.g., com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException).
  • Repeated failed login attempts (if authentication is bypassed).

Detection Engineering

YARA Rule

rule CVE_2025_5386_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts against JeeWMS cgformTransController"
        author = "Valters IT"
        date = "2025-05-05"
        reference = "CVE-2025-5386"
    strings:
        $sqli1 = "transEditor=" nocase
        $sqli2 = "' OR " nocase
        $sqli3 = "UNION SELECT" nocase
        $sqli4 = "SLEEP(" nocase
        $sqli5 = "--" nocase
    condition:
        all of ($sqli1, $sqli2, $sqli3, $sqli4, $sqli5)
}

Sigma Rule

title: CVE-2025-5386 JeeWMS SQL Injection Attempt
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts against the JeeWMS cgformTransController endpoint
author: Valters IT
date: 2025-05-05
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '/cgformTransController.do'
            - 'transEditor='
        cs-uri-query|contains|all:
            - "'"
            - 'OR'
            - 'UNION'
            - 'SLEEP'
    condition: selection
falsepositives:
    - Legitimate use of single quotes in parameter values (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-5386 JeeWMS SQL Injection Attempt"; flow:to_server,established; content:"/cgformTransController.do"; http_uri; content:"transEditor="; http_uri; pcre:"/(\x27|%27).*(OR|or|UNION|union|SLEEP|sleep)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application: If possible, take the JeeWMS instance offline or restrict network access to trusted IPs only.
2. Apply WAF rules: Block requests containing SQL injection patterns to the vulnerable endpoint.
3. Input validation: Implement strict input validation for the transEditor parameter (allow only alphanumeric characters if possible).

Long-term Fix:

• Upgrade to a patched version: Monitor the JeeWMS repository for an official fix. If none is forthcoming, consider migrating to an alternative WMS.
• Code remediation: Replace all dynamic SQL queries with parameterized statements (PreparedStatement) in the Java codebase.
• Security audit: Conduct a full security review of the application to identify similar vulnerabilities.

Workaround:

• Disable the cgformTransController.do endpoint by removing or renaming the servlet mapping in web.xml.

Valters IT