CVE-2025-9391

Executive Summary

CVE-2025-9391 is a critical SQL injection vulnerability discovered in the Bjskzy Zhiyou ERP system, affecting versions up to and including 11.0. The flaw resides in the com.artery.workflow.ServiceImpl component, specifically within the getFieldValue function. An attacker can manipulate the sql argument to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The exploit has been publicly released, and the vendor has not responded to disclosure attempts, leaving systems unpatched and at high risk.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited data modification.
• Availability Impact: Low (A:L) – Limited service disruption.

Threat Level: High due to public exploit availability and lack of vendor response.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the getFieldValue function of the com.artery.workflow.ServiceImpl class. The function accepts a sql parameter without proper sanitization or parameterization, allowing an attacker to inject malicious SQL statements. This can be exploited via HTTP requests to the ERP system's API endpoints that call this function.

Attack Flow:

1. An attacker identifies an endpoint that invokes getFieldValue with user-controlled input.
2. The attacker crafts a malicious SQL payload, e.g., ' OR '1'='1' --.
3. The payload is sent as the sql argument.
4. The backend executes the injected SQL, potentially returning unauthorized data or allowing further exploitation.

Impact:

• Data exfiltration of sensitive ERP data (e.g., user credentials, financial records).
• Data manipulation (e.g., altering inventory, payroll).
• Potential for privilege escalation or lateral movement within the network.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

public String getFieldValue(String sql) {
    Statement stmt = connection.createStatement();
    ResultSet rs = stmt.executeQuery(sql); // Direct concatenation
    // ...
}

Patched Code (Conceptual):

public String getFieldValue(String sql) {
    PreparedStatement pstmt = connection.prepareStatement(sql);
    // Use parameterized queries
    pstmt.setString(1, userInput);
    ResultSet rs = pstmt.executeQuery();
    // ...
}

The vulnerable code directly concatenates user input into the SQL query, while the patched version uses prepared statements to safely handle parameters.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Target: Bjskzy Zhiyou ERP v11.0 (or earlier) running on a local VM.
• Attacker: Kali Linux with sqlmap and curl.

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /workflow/getFieldValue).
2. Use sqlmap to automate injection:

   sqlmap -u "http://target.com/workflow/getFieldValue?sql=1" --batch --dbs
   

3. Manual exploitation with curl:

   curl "http://target.com/workflow/getFieldValue?sql=1' UNION SELECT @@version--"
   

Expected Output: Database version string returned in the response.

Blue Team (Defensive)

Detection:

• Monitor for unusual SQL keywords in HTTP parameters (e.g., UNION, SELECT, OR).
• Use WAF rules to block SQL injection patterns.

Response:

• Isolate affected systems immediately.
• Review logs for unauthorized data access.
• Apply virtual patching via WAF until official patch is available.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /workflow/getFieldValue with suspicious sql parameters.
  • Outbound database connections from the ERP server to unknown IPs.
• File IOCs:
  • Unexpected SQL query logs in application logs.
  • Modified database entries (e.g., altered user roles).
• Behavioral IOCs:
  • Unusual database queries (e.g., UNION SELECT, OR 1=1).
  • Increased database error messages.

Detection Engineering

YARA Rule

rule CVE_2025_9391_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-9391"
        author = "Valters IT"
        date = "2025-04-01"
    strings:
        $s1 = "getFieldValue" nocase
        $s2 = "sql=" nocase
        $s3 = "UNION" nocase
        $s4 = "SELECT" nocase
        $s5 = "OR" nocase
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5)
}

Sigma Rule

title: SQL Injection Attempt Against Zhiyou ERP
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts targeting CVE-2025-9391
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: "/workflow/getFieldValue"
        cs-uri-query|contains: "sql="
    keywords:
        - "UNION"
        - "SELECT"
        - "OR"
    condition: selection and keywords
falsepositives:
    - Legitimate use of SQL keywords in parameters
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-9391 SQL Injection Attempt"; flow:to_server; content:"/workflow/getFieldValue"; http_uri; content:"sql="; http_uri; pcre:"/(UNION|SELECT|OR)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems from the network if possible.
2. Apply WAF rules to block SQL injection patterns.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Upgrade to a patched version when available.
• Implement input validation and parameterized queries in all database interactions.
• Conduct code review of the getFieldValue function and similar components.

Workaround:

• Disable the vulnerable endpoint if not essential.
• Restrict access to the ERP system via firewall rules.

Valters IT