CVE-2025-0699: Joeybling Bootplus SQLi Vulnerability

CVE-2025-0699 Overview

CVE-2025-0699 is a SQL injection vulnerability in JoeyBling bootplus, an open-source administrative framework hosted on GitHub. The flaw exists in the /admin/sys/role/list endpoint, where the sort parameter is concatenated into a database query without proper sanitization. Remote attackers with low-privilege authenticated access can manipulate the sort argument to inject arbitrary SQL statements. The project does not use formal versioning, so all builds up to commit 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d are affected. The exploit has been publicly disclosed through VulDB and the project's GitHub issue tracker.

Critical Impact
Authenticated remote attackers can inject SQL through the sort parameter of the admin role listing endpoint, exposing data confidentiality, integrity, and availability of the underlying database.

Affected Products

JoeyBling bootplus (all builds up to commit 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d)
Component: /admin/sys/role/list endpoint
Vendor: JoeyBling (open-source GitHub project)

Discovery Timeline

2025-01-24 - CVE-2025-0699 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0699

Vulnerability Analysis

The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component, or Injection). The affected endpoint /admin/sys/role/list accepts a sort parameter intended to control the ordering of returned role records. The application incorporates this parameter directly into a SQL ORDER BY clause without applying parameterization or allowlist validation.

Sort-clause SQL injection is a common pattern in administrative listing endpoints. Standard prepared statements do not protect ORDER BY arguments because column identifiers cannot be bound as parameters. When developers omit a server-side allowlist for sortable columns, attacker-supplied SQL fragments execute in the database context. Attackers can chain stacked queries, time-based blind extraction, or UNION SELECT payloads depending on the backing database engine.

Root Cause

The root cause is the absence of input validation and parameter binding for the sort argument. The bootplus controller passes the raw query-string value into the ORM or MyBatis mapper, where it is interpolated into dynamic SQL. The lack of a sortable-column allowlist means any string is forwarded to the database.

Attack Vector

Exploitation requires network access to the bootplus administrative interface and a valid low-privilege session. An attacker submits a crafted HTTP request to /admin/sys/role/list with a malicious sort value containing SQL syntax. The injected payload executes within the database session backing the application, enabling enumeration of schema, extraction of credentials, or modification of administrative records. See the GitHub Issue Discussion and the VulDB Threat Report for proof-of-concept details.

Detection Methods for CVE-2025-0699

Indicators of Compromise

HTTP requests to /admin/sys/role/list containing SQL keywords such as SELECT, UNION, SLEEP, or -- in the sort parameter.
Unusual ORDER BY clauses or database errors logged by the bootplus application or backing database.
Authenticated sessions issuing high-frequency requests to administrative listing endpoints with varying sort values.

Detection Strategies

Inspect application and reverse-proxy logs for sort= query strings containing non-alphanumeric SQL metacharacters.
Deploy a Web Application Firewall rule that blocks SQL keywords in the sort parameter of /admin/sys/* endpoints.
Correlate database audit logs with application access logs to surface ORDER BY clauses referencing unexpected tables or functions.

Monitoring Recommendations

Enable verbose query logging on the MySQL or MariaDB backend used by bootplus to capture injected statements.
Alert on database errors originating from the bootplus connection pool, which often indicate injection probing.
Monitor for privilege escalation events on application-level admin accounts following requests to the affected endpoint.

How to Mitigate CVE-2025-0699

Immediate Actions Required

Restrict network access to the bootplus administrative interface to trusted management networks or VPN only.
Audit existing admin accounts and rotate credentials, since authenticated access is sufficient to exploit the flaw.
Deploy a WAF rule blocking SQL metacharacters in the sort parameter of /admin/sys/role/list.

Patch Information

No official patch has been released by the JoeyBling bootplus project at the time of NVD publication. Because the project does not use formal versioning, defenders should track the GitHub Issue Discussion for upstream fix commits and review subsequent commits against 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d.

Workarounds

Modify the bootplus source to validate the sort parameter against a hard-coded allowlist of permitted column names before query construction.
Replace direct string interpolation in the role-listing mapper with a server-side mapping function that translates client tokens to known-safe SQL identifiers.
If self-hosted modification is not feasible, disable or remove the /admin/sys/role/list endpoint until an upstream patch is available.

bash

# Example NGINX rule to block SQL metacharacters in the sort parameter
location /admin/sys/role/list {
    if ($arg_sort ~* "(select|union|sleep|benchmark|--|;|\bor\b|\band\b)") {
        return 403;
    }
    proxy_pass http://bootplus_backend;
}