CVE-2025-11944: Vvveb CMS SQL Injection Vulnerability

CVE-2025-11944 Overview

CVE-2025-11944 is a SQL injection vulnerability in givanz Vvveb through version 1.0.7.3. The flaw resides in the Import function of admin/controller/tools/import.php, specifically within the Raw SQL Handler component. Authenticated attackers with administrative privileges can manipulate SQL input remotely to influence database queries. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic abuse against unpatched instances. The vendor has issued patch 52204b4a106b2fb02d16eee06a88a1f2697f9b35, which removes the raw SQL import path entirely. This vulnerability is classified under [CWE-89] (SQL Injection) and [CWE-74] (Improper Neutralization of Special Elements in Output).

Critical Impact
Authenticated remote attackers can inject arbitrary SQL through the Vvveb admin import tool, potentially compromising the integrity and confidentiality of the underlying database.

Affected Products

Vvveb CMS versions up to and including 1.0.7.3
The admin/controller/tools/import.php Raw SQL Handler component
Deployments of Vvveb where administrative access is exposed to untrusted users

Discovery Timeline

2025-10-19 - CVE-2025-11944 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-11944

Vulnerability Analysis

The vulnerability exists in the import functionality of Vvveb's administrative interface. The Import class in admin/controller/tools/import.php instantiated a Vvveb\System\Import\Sql handler that accepted raw SQL payloads for execution against the application database. Because input passed to this handler was not adequately sanitized or parameterized, attackers could inject arbitrary SQL statements through the import workflow. Exploitation requires high privileges, since the import endpoint sits behind the administrative panel. However, scenarios involving lower-privileged backend users, compromised admin sessions, or stored cross-site request forgery against an administrator can extend the practical attack surface.

Root Cause

The root cause is the inclusion of a raw SQL import option that executed user-supplied SQL without query parameterization or strict validation. The design conflated trusted administrative configuration with untrusted file content, allowing input that should be treated as data to be executed as code by the database engine.

Attack Vector

The attack is initiated remotely over the network against the Vvveb administrative panel. An authenticated user with import privileges submits a crafted SQL payload through the import tool, which the vulnerable handler passes to the database. The result can include data exfiltration, modification of stored content, privilege manipulation, or destructive operations against the application schema.

php

// Patch diff from admin/controller/tools/import.php
 use function Vvveb\__;
 use Vvveb\Controller\Base;
-use Vvveb\System\Import\Sql;
 use Vvveb\System\Import\Xml;
 
 #[\AllowDynamicProperties]
 class Import extends Base {
 	function __construct() {
 		$this->xml = new Xml();
-		$this->sql = new Sql();
 	}
 
 	function importFile($file, $name = '') {

Source: GitHub commit 52204b4a — The fix removes the raw SQL import handler entirely, leaving only the XML importer.

Detection Methods for CVE-2025-11944

Indicators of Compromise

Web server access logs showing POST requests to admin/controller/tools/import.php or admin import routes with payloads containing SQL keywords such as UNION, SELECT, DROP, or INSERT.
Uploaded import files with .sql extensions or MIME types indicating raw SQL content.
Unexpected database schema changes, new administrative accounts, or modified user role tables shortly after import activity.

Detection Strategies

Inspect application and web server logs for invocations of the import handler and correlate them against authorized administrator activity windows.
Enable database query logging on the Vvveb backend to identify anomalous statements originating from the PHP application process.
Apply web application firewall (WAF) signatures that detect SQL injection patterns in multipart file uploads to admin endpoints.

Monitoring Recommendations

Alert on any successful authentication to the Vvveb admin panel from non-allowlisted IP ranges or outside business hours.
Track filesystem changes to admin/controller/tools/import.php and related Vvveb\System\Import\Sql classes to verify patch application.
Monitor for sudden growth in database tables or dump-style queries that may indicate exfiltration attempts.

How to Mitigate CVE-2025-11944

Immediate Actions Required

Upgrade Vvveb to a version that includes commit 52204b4a106b2fb02d16eee06a88a1f2697f9b35 or later, which removes the raw SQL import path.
Restrict access to the /admin interface using network controls, VPN, or IP allowlisting to limit exposure of the import functionality.
Audit administrative accounts and rotate credentials if logs indicate suspicious import activity prior to patching.

Patch Information

The vendor fix is published in the Vvveb GitHub repository under commit 52204b4a106b2fb02d16eee06a88a1f2697f9b35. Additional context is available in GitHub Issue #332 and the VulDB entry #329024.

Workarounds

If immediate patching is not possible, manually remove the use Vvveb\System\Import\Sql; reference and $this->sql = new Sql(); instantiation from admin/controller/tools/import.php to disable the raw SQL handler.
Apply a database account least-privilege model so the Vvveb runtime user cannot execute schema modifications or access sensitive tables beyond the application scope.
Deploy a WAF rule that blocks multipart/form-data uploads containing SQL syntax to administrative import endpoints.

bash

# Verify the patch is applied in a deployed Vvveb installation
grep -n "Vvveb\\\\System\\\\Import\\\\Sql" admin/controller/tools/import.php
# Expected result after patch: no matches

# Confirm the installed commit includes the fix
cd /path/to/Vvveb && git log --oneline | grep 52204b4a