CVE-2025-0698: JoeyBling Bootplus SQLi Vulnerability

CVE-2025-0698 Overview

CVE-2025-0698 is a SQL injection vulnerability affecting JoeyBling bootplus up to commit 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. The flaw exists in the /admin/sys/menu/list endpoint, where the sort and order request parameters are concatenated into a database query without proper sanitization. An authenticated remote attacker can manipulate these parameters to inject arbitrary SQL. The issue is tracked as [CWE-74] (Improper Neutralization of Special Elements in Output). The project uses continuous rolling releases, so no discrete affected or fixed version identifiers are published. The exploit details have been disclosed publicly.

Critical Impact
Authenticated attackers can inject SQL through the sort and order parameters at /admin/sys/menu/list, exposing administrative database contents to unauthorized read, modification, or exfiltration.

Affected Products

JoeyBling bootplus up to commit 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d
Rolling release builds prior to remediation of the /admin/sys/menu/list handler
Deployments exposing the administrative interface to untrusted networks

Discovery Timeline

2025-01-24 - CVE-2025-0698 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0698

Vulnerability Analysis

The vulnerability resides in the administrative menu listing handler at /admin/sys/menu/list. The endpoint accepts sort and order parameters intended to control result ordering in the underlying SQL query. Instead of validating these values against an allow-list of column names and directions, the application concatenates them directly into the ORDER BY clause of the query. This allows an attacker with access to an authenticated session to break out of the intended clause and append arbitrary SQL. Because bootplus uses continuous delivery without versioned releases, defenders cannot pin remediation to a specific tag and must track the upstream repository.

Root Cause

The root cause is missing input neutralization on ordering parameters, classified as [CWE-74]. Frameworks typically cannot use bound parameters for identifiers such as column names, so developers must apply strict allow-listing. In bootplus, no such allow-list exists for the sort and order inputs feeding into /admin/sys/menu/list, which allows SQL fragments to reach the query builder unchanged.

Attack Vector

Exploitation requires network reachability to the admin panel and a valid low-privilege authenticated session. The attacker submits a crafted HTTP request to /admin/sys/menu/list with a sort or order value containing a UNION, subquery, or boolean-based payload. The database interprets the injected fragment, returning attacker-controlled data or executing follow-on statements. No user interaction is required beyond issuing the request. See the GitHub Issue Discussion for a reproduction thread and the VulDB entry for technical metadata.

Detection Methods for CVE-2025-0698

Indicators of Compromise

HTTP requests to /admin/sys/menu/list containing SQL keywords such as UNION, SELECT, SLEEP, or -- in the sort or order query parameters.
Application or database error messages referencing syntax failures in ORDER BY clauses generated by the menu listing handler.
Unexpected outbound queries or bulk row reads from the sys_menu table or adjacent administrative tables shortly after authenticated admin sessions.

Detection Strategies

Deploy WAF or reverse proxy rules that block non-alphanumeric characters in sort and order parameters targeting /admin/sys/menu/list.
Enable database query logging and alert on ORDER BY clauses containing subqueries, comment tokens, or stacked statements.
Correlate authenticated admin session activity with anomalous query patterns to surface post-login exploitation attempts.

Monitoring Recommendations

Forward web server, application, and database logs to a centralized analytics platform for cross-source correlation.
Track baseline request patterns for /admin/sys/menu/* endpoints and alert on deviations in parameter length or entropy.
Monitor for privilege changes or new administrative accounts created immediately after suspicious menu/list requests.

How to Mitigate CVE-2025-0698

Immediate Actions Required

Restrict network access to /admin/* routes so that only trusted administrators reach the panel.
Rotate credentials for any administrative accounts that may have been used from untrusted networks since disclosure.
Review database audit logs for evidence of injection payloads submitted through the sort or order parameters.

Patch Information

Because bootplus follows a rolling-release model, no version-labeled fix is published. Administrators should pull the latest commit from the bootplus repository and confirm that the /admin/sys/menu/list handler validates sort and order against an explicit allow-list of column names and directions. Track the upstream issue for remediation status before promoting builds to production.

Workarounds

Apply a WAF virtual patch that rejects sort and order values not matching a strict pattern such as ^[A-Za-z_]+$ and ^(asc|desc)$.
Place the administrative interface behind VPN or IP allow-listing to reduce exposure while an upstream fix is prepared.
Enforce least-privilege database credentials for the application account so that injected queries cannot read or modify unrelated schemas.

bash

# Example NGINX rule to block suspicious ORDER BY payloads
location = /admin/sys/menu/list {
    if ($arg_sort  ~* "[^A-Za-z_]") { return 400; }
    if ($arg_order ~* "^(?!(asc|desc)$)") { return 400; }
    proxy_pass http://bootplus_backend;
}