CVE-2019-25348: Computrols CBAS-Web SQLi Vulnerability

CVE-2019-25348 Overview

CVE-2019-25348 is a boolean-based blind SQL injection vulnerability affecting Computrols CBAS-Web version 19.0.0. The vulnerability exists in the id parameter of the servers endpoint, allowing authenticated attackers to manipulate database queries. By crafting malicious boolean-based SQL injection payloads, attackers can extract or infer sensitive database information, potentially compromising the integrity and confidentiality of the building automation system.

Critical Impact

Authenticated attackers can exploit this SQL injection vulnerability to extract sensitive database information from building automation systems, potentially exposing critical infrastructure data and enabling further attacks on connected building management systems.

Affected Products

• Computrols CBAS-Web 19.0.0
• Building Automation Software utilizing vulnerable CBAS-Web components
• Systems with the affected servers endpoint accessible to authenticated users

Discovery Timeline

• 2026-02-12 - CVE-2019-25348 published to NVD
• 2026-02-12 - Last updated in NVD database

Technical Details for CVE-2019-25348

Vulnerability Analysis

This vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), commonly known as SQL Injection. The flaw resides in the servers endpoint of Computrols CBAS-Web 19.0.0, where the id parameter fails to properly sanitize user-supplied input before incorporating it into SQL queries.

The boolean-based blind nature of this SQL injection means that attackers cannot directly view query results in the application's response. Instead, they must infer database contents by observing differences in application behavior based on true or false conditions injected into the query. This technique, while slower than error-based or union-based SQL injection, remains highly effective for data exfiltration.

Building automation systems like CBAS-Web typically manage sensitive operational data including access credentials, system configurations, and building sensor information. Successful exploitation could allow attackers to access this data, potentially enabling physical security compromises or disruption of building operations.

Root Cause

The root cause of this vulnerability is insufficient input validation and lack of parameterized queries in the servers endpoint. When the application processes the id parameter, it directly concatenates user input into SQL statements without proper sanitization or the use of prepared statements. This allows attackers to inject SQL syntax that alters the intended query logic.

The absence of proper input validation mechanisms such as allowlisting, escaping special characters, or implementing parameterized queries enables the SQL injection attack vector.

Attack Vector

The attack is network-accessible and requires low-privilege authentication to exploit. An authenticated attacker can target the servers endpoint by manipulating the id parameter with boolean-based SQL injection payloads. The attacker sends requests containing true/false conditions and observes response differences to systematically extract database information character by character.

For example, an attacker might inject payloads that test whether specific characters exist at certain positions in database fields. By analyzing the application's responses to these boolean conditions, the attacker can reconstruct sensitive data such as usernames, passwords, configuration values, or other stored information.

Detailed technical information about this vulnerability can be found in the VulnCheck CBAS Web SQL Injection Advisory and the Exploit-DB #47631 entry.

Detection Methods for CVE-2019-25348

Indicators of Compromise

• Unusual or repetitive requests to the servers endpoint with varying id parameter values containing SQL syntax
• HTTP requests containing SQL keywords such as AND, OR, SLEEP, WAITFOR, or boolean operators in the id parameter
• Abnormal response time patterns indicating time-based blind SQL injection attempts
• Multiple failed or anomalous authentication attempts followed by server endpoint access

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in HTTP parameters
• Deploy database activity monitoring to identify unusual query patterns or unauthorized data access attempts
• Configure application logging to capture detailed request parameters for forensic analysis
• Use SentinelOne's behavioral AI to detect anomalous application behavior indicative of exploitation attempts

Monitoring Recommendations

• Monitor all HTTP requests to the servers endpoint for SQL injection indicators in the id parameter
• Establish baseline response times and alert on significant deviations that may indicate time-based SQL injection
• Review database audit logs for unauthorized SELECT statements or unusual query patterns
• Implement real-time alerting for multiple consecutive requests with SQL syntax in parameters

How to Mitigate CVE-2019-25348

Immediate Actions Required

• Restrict network access to CBAS-Web interfaces to trusted networks and administrators only
• Implement Web Application Firewall rules to filter SQL injection patterns from incoming requests
• Review and audit all authenticated user accounts for unauthorized access
• Enable comprehensive logging on the CBAS-Web application and database to detect exploitation attempts

Patch Information

Organizations should contact Computrols directly for information regarding security patches or updated versions that address this vulnerability. Review the Computrols Building Automation Software page and CBAS Web Capabilities documentation for the latest product updates and security guidance.

Workarounds

• Deploy a Web Application Firewall (WAF) configured to block SQL injection attempts targeting the servers endpoint
• Implement network segmentation to isolate building automation systems from general network access
• Apply principle of least privilege to all CBAS-Web user accounts to minimize potential impact
• Consider disabling or restricting access to the servers endpoint until a patch is available

# Example WAF rule to block SQL injection patterns (ModSecurity)
SecRule ARGS:id "@detectSQLi" \
    "id:100001,\
    phase:2,\
    deny,\
    status:403,\
    log,\
    msg:'SQL Injection Attempt Blocked in id parameter',\
    tag:'application-multi',\
    tag:'language-multi',\
    tag:'platform-multi',\
    tag:'attack-sqli'"