CVE-2025-1185: Pihome Maxair SQL Injection Vulnerability

CVE-2025-1185 Overview

CVE-2025-1185 is a SQL injection vulnerability affecting pihome-shc PiHome 2.0, a smart home controller platform. The flaw resides in the /ajax.php?Ajax=GetModal_Sensor_Graph endpoint, where user-controlled input is incorporated into a database query without proper sanitization [CWE-74]. Remote attackers with low privileges can manipulate the request parameters to inject arbitrary SQL syntax. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic exploitation against exposed instances. The vulnerability requires network access but no user interaction, making it suitable for automated scanning and exploitation.

Critical Impact
Authenticated remote attackers can inject SQL statements through the sensor graph AJAX endpoint, potentially exposing or modifying backend database contents on PiHome 2.0 deployments.

Affected Products

pihome-shc PiHome 2.0
PiHome Maxair 2.0
Deployments exposing /ajax.php to untrusted networks

Discovery Timeline

2025-02-12 - CVE-2025-1185 published to the National Vulnerability Database (NVD)
2025-10-17 - Last updated in NVD database

Technical Details for CVE-2025-1185

Vulnerability Analysis

The vulnerability is a SQL injection flaw classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The affected component is the GetModal_Sensor_Graph AJAX handler invoked through /ajax.php. The handler accepts request parameters that are concatenated directly into a SQL query executed against the PiHome backend database. An attacker authenticated with low privileges can submit crafted parameter values to alter query semantics. The injected statements execute in the security context of the database account used by the PiHome web application.

Root Cause

The root cause is the absence of parameterized queries or input validation in the sensor graph data retrieval logic. User-supplied values reach the SQL execution layer without escaping or type enforcement. The application trusts the structure of AJAX request parameters submitted through the front-end interface.

Attack Vector

The attack vector is network-based and requires low-privileged authentication to the PiHome web interface. An attacker sends an HTTP request to /ajax.php?Ajax=GetModal_Sensor_Graph containing malicious SQL payloads in the vulnerable parameter. The injected payload modifies the underlying query to extract, modify, or enumerate database records. A public proof-of-concept exists in the janssensjelle published-pocs repository. Additional technical context is available in the VulDB entry #295089.

Detection Methods for CVE-2025-1185

Indicators of Compromise

HTTP requests to /ajax.php?Ajax=GetModal_Sensor_Graph containing SQL meta-characters such as single quotes, UNION, SELECT, --, or /* in parameter values
Database error responses returned to clients accessing the sensor graph endpoint
Anomalous query patterns or high volumes of requests to the sensor graph handler from a single source
Outbound database queries reading from information_schema or system tables initiated by the PiHome web user

Detection Strategies

Inspect web server access logs for requests to /ajax.php with encoded SQL syntax or unusually long parameter values
Deploy a web application firewall (WAF) ruleset to flag SQL injection signatures against the PiHome web tier
Correlate authentication events with subsequent abuse of the sensor graph endpoint to identify low-privileged accounts conducting reconnaissance

Monitoring Recommendations

Enable database query logging on the PiHome backend and alert on queries referencing schema metadata
Forward web server and database logs to a centralized analytics platform for retention and correlation
Monitor for new or unexpected accounts created in the PiHome application following suspicious AJAX activity

How to Mitigate CVE-2025-1185

Immediate Actions Required

Restrict access to the PiHome web interface to trusted management networks using firewall rules or VPN gating
Audit existing PiHome user accounts and rotate credentials for any low-privileged accounts that may be abused
Review web and database logs for prior exploitation attempts against /ajax.php?Ajax=GetModal_Sensor_Graph

Patch Information

At the time of publication, no vendor advisory or official patch has been linked in the NVD record for CVE-2025-1185. Monitor the pihome-shc project channels and VulDB entry #295089 for remediation updates. Until a fix is available, treat all PiHome 2.0 deployments as exposed and apply compensating controls.

Workarounds

Place the PiHome application behind a reverse proxy with a WAF configured to block SQL injection patterns targeting /ajax.php
Apply least-privilege principles to the database account used by PiHome, removing rights to schema introspection and write operations where feasible
Disable or block external exposure of the sensor graph AJAX endpoint if it is not required for normal operation

bash

# Example: restrict PiHome web access to a management subnet using iptables
iptables -A INPUT -p tcp --dport 80 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP

# Example: block requests to the vulnerable endpoint at the reverse proxy (nginx)
location ~* /ajax\.php {
    if ($arg_Ajax = "GetModal_Sensor_Graph") {
        return 403;
    }
}