CVE-2025-0489: Native-php-cms SQL Injection Vulnerability

CVE-2025-0489 Overview

CVE-2025-0489 is a SQL injection vulnerability in Fanli2012 native-php-cms version 1.0. The flaw resides in the /fladmin/friendlink_dodel.php script, where the id parameter is passed directly into a database query without proper sanitization. Attackers with low-privileged authenticated access can manipulate the id argument to inject arbitrary SQL statements. The vulnerability is remotely exploitable over the network and has been publicly disclosed via GitHub and VulDB. The issue is tracked under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Authenticated attackers can inject SQL commands through the id parameter of friendlink_dodel.php to read, modify, or delete backend database records in native-php-cms 1.0.

Affected Products

Fanli2012 native-php-cms 1.0
Component: /fladmin/friendlink_dodel.php
CPE: cpe:2.3:a:native-php-cms_project:native-php-cms:1.0:*:*:*:*:*:*:*

Discovery Timeline

2025-01-15 - CVE-2025-0489 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0489

Vulnerability Analysis

The vulnerability exists in the friend-link deletion handler of the native-php-cms administrative interface. The script /fladmin/friendlink_dodel.php accepts an id value from an HTTP request and concatenates it directly into a SQL query used to remove a friend-link record. Because the input is neither validated nor parameterized, malicious SQL fragments passed as the id value execute against the backend database.

Exploitation requires only network reachability to the administrative endpoint and low-privileged access. The publicly disclosed proof of concept in the vendor GitHub issue demonstrates that the attack succeeds without user interaction. Successful injection may allow attackers to enumerate table structures, extract credentials, tamper with content records, or destroy data.

Root Cause

The root cause is missing input neutralization on the id request parameter before it is used to build a SQL statement. The application does not enforce integer casting, prepared statements, or parameter binding. This coding pattern is characteristic of [CWE-74] injection weaknesses and is common across legacy PHP CMS platforms that build queries via string concatenation.

Attack Vector

An attacker sends a crafted HTTP request to /fladmin/friendlink_dodel.php with a malicious payload appended to the id parameter. Because the endpoint sits under the /fladmin/ administrative path, exploitation typically presumes a valid administrative session or a chained authentication bypass. Once the payload reaches the query builder, the injected clauses execute in the context of the CMS database user. Refer to the Fanli2012 native-php-cms GitHub Issue #11 and VulDB Entry #291934 for the disclosed proof of concept.

Detection Methods for CVE-2025-0489

Indicators of Compromise

HTTP requests to /fladmin/friendlink_dodel.php containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( in the id parameter.
Unexpected DELETE or SELECT queries against the friendlink table originating from the CMS database user.
Web server access logs showing repeated requests to friendlink_dodel.php with anomalously long or URL-encoded id values.

Detection Strategies

Deploy web application firewall rules that inspect the id parameter on all /fladmin/ endpoints for SQL injection signatures.
Enable database query logging and alert on queries against the friendlink table that include boolean tautologies or stacked statements.
Correlate administrative endpoint access with source IP reputation and session anomalies to surface unauthorized use.

Monitoring Recommendations

Monitor authentication logs for administrative logins preceding friendlink_dodel.php traffic bursts.
Track database error rates from the CMS; injection attempts frequently produce syntax errors before successful payloads.
Alert on outbound data flows from the database server that could indicate data exfiltration following a successful injection.

How to Mitigate CVE-2025-0489

Immediate Actions Required

Restrict network access to the /fladmin/ administrative directory using IP allowlisting or VPN-only reachability.
Rotate administrative credentials and audit all CMS admin accounts for unauthorized additions.
Review database logs for prior exploitation attempts against friendlink_dodel.php and preserve evidence.

Patch Information

No official vendor patch has been published at the time of NVD disclosure. The vulnerability is tracked publicly in the Fanli2012 native-php-cms GitHub Issue and cataloged in VulDB CTI Entry #291934. Operators should monitor the upstream repository for a fix that adds parameterized queries or strict integer casting on the id argument.

Workarounds

Apply a virtual patch at the WAF or reverse proxy layer that rejects non-numeric values for the id parameter on friendlink_dodel.php.
Modify the source of friendlink_dodel.php to cast $_GET['id'] and $_POST['id'] to an integer with intval() before use in any SQL statement.
If the friend-link management feature is unused, remove or rename the friendlink_dodel.php file to eliminate the attack surface.

bash

# Example nginx virtual patch: reject non-numeric id values
location = /fladmin/friendlink_dodel.php {
    if ($arg_id !~ ^[0-9]+$) {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}