CVE-2025-0334: Leiyuxi Cy-fast SQL Injection Vulnerability

CVE-2025-0334 Overview

CVE-2025-0334 is a SQL injection vulnerability in leiyuxi cy-fast version 1.0. The flaw resides in the listData function exposed through the /sys/user/listData endpoint. Attackers can manipulate the order parameter to inject arbitrary SQL statements into backend database queries.

The vulnerability is exploitable remotely over the network and requires only low-level authentication. Public disclosure of exploitation details has been made through VulDB and a GitHub advisory, increasing exposure for unpatched deployments.

Critical Impact
Authenticated remote attackers can inject SQL through the order parameter of /sys/user/listData, enabling unauthorized data access, modification, or extraction from the cy-fast database.

Affected Products

leiyuxi cy-fast 1.0
Component: sys/user/listData endpoint
CPE: cpe:2.3:a:leiyuxi:cy-fast:1.0

Discovery Timeline

2025-01-09 - CVE-2025-0334 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0334

Vulnerability Analysis

The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command) and [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The cy-fast application accepts user-supplied input through the order parameter of the /sys/user/listData request handler. This input is concatenated directly into a SQL statement without parameterization or sanitization.

Attackers control the ordering clause of the generated query, which is a frequent injection point because ORDER BY parameters cannot be parameterized in standard prepared statements. The downstream database executes attacker-supplied SQL fragments with the privileges of the application database user.

The EPSS score is 0.467% with a percentile of 36.8, reflecting observed exploitation likelihood across the broader internet population.

Root Cause

The root cause is dynamic SQL construction in the listData handler. The order argument is interpolated into the query string instead of being validated against an allowlist of column names or sort directions. The framework does not enforce type or schema constraints on the sort parameter before query execution.

Attack Vector

An authenticated attacker sends an HTTP request to /sys/user/listData with a crafted order parameter containing SQL syntax such as conditional expressions, UNION SELECT statements, or time-based payloads. The injected SQL executes within the database context, allowing data exfiltration, schema enumeration, or modification depending on the database account permissions.

The attack requires network reachability to the application and a low-privilege authenticated session. No user interaction is required. Public exploit details are referenced in the GitHub SQL Injection Guide and the VulDB Threat Intelligence Report.

Detection Methods for CVE-2025-0334

Indicators of Compromise

HTTP requests to /sys/user/listData containing SQL keywords such as SELECT, UNION, SLEEP, or BENCHMARK within the order parameter
Unusual database query response times indicating time-based blind SQL injection probing
Application logs showing repeated requests to /sys/user/listData with varying order values from a single source IP
Database error messages logged by the application referencing syntax issues in ORDER BY clauses

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the order parameter for SQL metacharacters and reserved keywords
Enable database query logging and alert on queries containing concatenated ORDER BY clauses with non-column identifiers
Implement runtime application self-protection (RASP) to identify SQL injection patterns in real time
Correlate authentication events with subsequent anomalous requests to administrative endpoints

Monitoring Recommendations

Monitor outbound traffic from the database server for unexpected data egress that may indicate exfiltration
Track query latency baselines on the sys_user table to identify time-based injection attempts
Audit authenticated user sessions accessing /sys/user/listData and flag accounts issuing high request volumes
Review database account permissions and alert on privilege escalation attempts originating from the application service account

How to Mitigate CVE-2025-0334

Immediate Actions Required

Restrict network access to the cy-fast application using firewall rules or VPN-only access until a patch is applied
Apply input validation at the application layer to allowlist permitted values for the order parameter
Reduce the database account privileges used by cy-fast to the minimum required for application function
Review historical access logs for /sys/user/listData to identify prior exploitation attempts

Patch Information

No official vendor patch is referenced in the available advisory data. Administrators should monitor the leiyuxi cy-fast project and the VulDB entry for upstream remediation. Until a fix is released, apply the workarounds below.

Workarounds

Implement an allowlist filter that permits only known column names and ASC/DESC values for the order parameter
Deploy WAF signatures blocking SQL metacharacters in requests to /sys/user/listData
Disable or restrict access to the /sys/user/listData endpoint if it is not required for production operations
Enforce parameterized queries or use an ORM-supplied sort builder that validates identifiers against the schema

bash

# Example WAF rule (ModSecurity) blocking SQL keywords in the order parameter
SecRule ARGS:order "@rx (?i)(union|select|sleep|benchmark|--|;|/\*)" \
    "id:1000334,phase:2,deny,status:403,\
    msg:'CVE-2025-0334 cy-fast SQLi attempt in order parameter'"