CVE-2025-10122: Maccms SQL Injection Vulnerability

CVE-2025-10122 Overview

CVE-2025-10122 is a SQL injection vulnerability in Maccms10 version 2025.1000.4050. The flaw resides in the rep function of the application/admin/controller/Database.php file. Attackers can manipulate the where argument to inject arbitrary SQL statements into backend database queries. The vulnerability is exploitable remotely, and a public exploit description has been released. The issue is classified under [CWE-74] (Improper Neutralization of Special Elements in Output). Exploitation requires high privileges, since the affected endpoint is part of the administrative interface.

Critical Impact
Authenticated administrators can inject arbitrary SQL queries through the where parameter, enabling potential disclosure or modification of database contents.

Affected Products

Maccms10 2025.1000.4050
application/admin/controller/Database.php component
Deployments exposing the admin interface to untrusted networks

Discovery Timeline

2025-09-09 - CVE-2025-10122 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10122

Vulnerability Analysis

The vulnerability exists in the rep function within application/admin/controller/Database.php. The function accepts a where parameter from HTTP request input and incorporates it into a SQL statement without proper sanitization or parameterized query handling. Because the input flows directly into a query context, an attacker controlling the where argument can break out of the intended query structure and append arbitrary SQL clauses. The attack vector is network-based, and exploitation requires authenticated access with administrative privileges.

Root Cause

The root cause is improper neutralization of user-controlled input passed to a database query builder. The rep handler concatenates the where parameter into SQL without enforcing allow-list validation or binding placeholders. This violates the principle that untrusted input must never be interpolated into query strings.

Attack Vector

An authenticated administrator sends a crafted HTTP request to the admin route that invokes the rep function. The where parameter contains SQL syntax such as boolean tautologies, UNION SELECT payloads, or stacked statements depending on the database driver configuration. The injected payload executes within the context of the application's database user. Since this is a post-authentication vector requiring high privileges, the practical risk depends on the strength of admin credential controls and exposure of the admin panel.

No verified proof-of-concept code is published in the NVD reference set. Technical details are described in the GitHub Information Resource and VulDB entry #323092.

Detection Methods for CVE-2025-10122

Indicators of Compromise

HTTP requests to admin routes invoking Database.php containing SQL metacharacters such as ', --, UNION, or SLEEP( in the where parameter.
Database error messages or unusually long response times correlated with admin database management requests.
Unexpected administrative session activity originating from non-corporate IP ranges.

Detection Strategies

Inspect web server access logs for requests targeting the admin database controller with abnormal where parameter values.
Deploy web application firewall rules that detect SQL injection patterns on parameters delivered to /admin/database/rep.
Correlate authentication logs with subsequent database query anomalies to identify abuse of compromised admin accounts.

Monitoring Recommendations

Enable verbose query logging on the application database and alert on syntactically unusual statements generated by the web application user.
Monitor for spikes in admin endpoint access volume or from previously unseen source addresses.
Track failed admin login attempts to detect credential stuffing prior to exploitation.

How to Mitigate CVE-2025-10122

Immediate Actions Required

Restrict access to the Maccms admin interface to trusted IP ranges using network controls or reverse proxy ACLs.
Rotate administrative credentials and enforce strong, unique passwords with multi-factor authentication where supported.
Audit recent admin session activity for unauthorized requests against application/admin/controller/Database.php.

Patch Information

At the time of NVD publication, no vendor advisory or patched release is listed in the references for CVE-2025-10122. Track the VulDB entry and the upstream Maccms repository for an official fix. When a patched build is released, upgrade beyond 2025.1000.4050.

Workarounds

Block external access to the /admin path at the reverse proxy until a vendor patch is available.
Apply WAF signatures that reject SQL metacharacters in the where parameter of database management requests.
Reduce the privileges of the database account used by the application so injected queries cannot read or modify data outside the application schema.

bash

# Example nginx restriction limiting admin access to a trusted CIDR
location ^~ /admin/ {
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://maccms_backend;
}