Listen to this Post
The CVE-2025-66260 vulnerability is a SQL injection flaw in the `status_sql.php` endpoint of DB Electronica Telecomunicazioni S.p.A.’s Mozart FM Transmitter software. This endpoint handles status updates by constructing SQL UPDATE queries using user-supplied `sw1` and `sw2` parameters directly concatenated into the query string without sanitization. The code fails to employ parameterized queries or PostgreSQL’s `pg_escape_string()` function, making it susceptible to injection attacks. Although PostgreSQL’s `pg_exec` function restricts execution to single queries, preventing stacked queries, attackers can inject subqueries within the UPDATE statement. By manipulating `sw1` and `sw2` parameters, malicious SQL code can be embedded to alter query logic. This allows data exfiltration through subqueries that retrieve sensitive information from the database. Verbose error messages from PostgreSQL further aid attackers by revealing database structure details during reconnaissance. The vulnerability affects multiple transmitter versions, including 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, and 7000. Exploitation occurs via HTTP requests to the vulnerable endpoint, where injected payloads in parameters bypass input validation. Attackers can craft payloads to perform UNION-based attacks or blind SQL injection to extract data. The lack of input escaping means simple payloads like `’ OR ‘1’=’1` can manipulate queries. This flaw highlights common web application security failures in direct string concatenation for SQL commands. The impact is significant as it compromises database confidentiality and integrity. Mitigation requires proper query parameterization and input sanitization to prevent unauthorized access.
Platform: Mozart FM Transmitter
Version: Multiple affected versions
Vulnerability: SQL Injection
Severity: Critical
Date: 11/25/2025
Prediction: Patch date TBD
What Undercode Say:
Analytics:
- Bash testing command: `curl -X POST http://target/status_sql.php -d “sw1=1’&sw2=1′”`
– Vulnerable PHP code:
$sw1 = $_POST[‘sw1’];
$sw2 = $_POST[‘sw2’];
$query = “UPDATE status SET value = ‘$sw1’ WHERE id = ‘$sw2′”;
pg_exec($conn, $query);
?>
how Exploit:
Craft HTTP requests with SQL payloads in sw1/sw2 parameters to extract data via error-based or blind injection techniques.
Protection from this CVE
Use parameterized queries with pg_prepare() and pg_execute(), escape inputs with pg_escape_string(), and implement strict input validation.
Impact:
Unauthorized database access, data exfiltration, and potential system compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
