CVE-2025-13171: Zzcms SQL Injection Vulnerability

CVE-2025-13171 Overview

CVE-2025-13171 is a SQL injection vulnerability in ZZCMS 2023, affecting the /admin/wangkan_list.php script. The flaw stems from improper sanitization of the keyword argument, allowing attackers to inject arbitrary SQL statements into backend database queries. The vulnerability is exploitable remotely and requires only low-privileged authentication. A public proof-of-concept is available, increasing the likelihood of opportunistic exploitation against exposed ZZCMS deployments. The issue is tracked under [CWE-89] (SQL Injection) and [CWE-74] (Injection).

Critical Impact
Authenticated remote attackers can manipulate the keyword parameter to execute arbitrary SQL queries, potentially exposing or modifying ZZCMS database contents.

Affected Products

ZZCMS 2023
Component: /admin/wangkan_list.php
Vulnerable parameter: keyword

Discovery Timeline

2025-11-14 - CVE-2025-13171 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-13171

Vulnerability Analysis

The vulnerability resides in the administrative script /admin/wangkan_list.php within ZZCMS 2023. The script accepts a keyword argument from HTTP requests and concatenates the value into a SQL query without proper parameterization or input sanitization. This pattern enables classic in-band SQL injection.

An attacker with low-privilege administrative access can craft a malicious keyword value to alter query semantics. Depending on database privileges, the attacker may enumerate tables, read sensitive records, or modify data. The attack vector is network-based and does not require user interaction.

Because ZZCMS is a content management system commonly used for B2B portals, exposed admin interfaces increase the practical attack surface. A public proof-of-concept is referenced in the GitHub SQL Injection PoC.

Root Cause

The root cause is missing input validation and the use of dynamic SQL string construction in wangkan_list.php. User-supplied input from the keyword parameter is incorporated into a query without prepared statements or escaping, violating secure coding practices outlined in [CWE-89].

Attack Vector

Exploitation occurs over HTTP against the administrative endpoint. An authenticated attacker submits a crafted keyword value containing SQL metacharacters. The PoC demonstrates payload structure and injection points; see the GitHub SQL Injection PoC Details and the VulDB entry for additional analysis.

// Example exploitation pattern (conceptual)
// GET /admin/wangkan_list.php?keyword=<SQL_PAYLOAD>
// The keyword value is concatenated into the backing SQL statement
// without parameterization, enabling UNION-based or boolean-based injection.

Detection Methods for CVE-2025-13171

Indicators of Compromise

HTTP requests to /admin/wangkan_list.php containing SQL metacharacters such as ', ", UNION, SELECT, --, or OR 1=1 in the keyword parameter.
Unexpected database errors or anomalous query response sizes correlated with requests to the affected endpoint.
Administrative session activity originating from unfamiliar IP addresses or geographies.

Detection Strategies

Inspect web server access logs for keyword parameter values containing SQL syntax tokens or URL-encoded equivalents (%27, %20OR%20, %23).
Deploy web application firewall (WAF) signatures targeting SQL injection patterns on the /admin/wangkan_list.php route.
Enable database query logging and alert on syntactically malformed or unusually structured queries originating from the ZZCMS application user.

Monitoring Recommendations

Monitor authentication events for the ZZCMS administrative interface and alert on brute-force or credential-stuffing attempts.
Track outbound database connections and data egress volumes from the ZZCMS host for anomalies indicating exfiltration.
Correlate WAF blocks, application errors, and database logs to identify reconnaissance prior to successful exploitation.

How to Mitigate CVE-2025-13171

Immediate Actions Required

Restrict network access to the /admin/ directory using IP allowlists or VPN-gated access until a vendor patch is available.
Audit administrative accounts and rotate credentials for any low-privileged accounts that could be leveraged for exploitation.
Review web server and database logs for prior exploitation attempts against wangkan_list.php.

Patch Information

No official vendor patch has been published in the references at the time of NVD publication. Monitor the VulDB advisory and the ZZCMS vendor channels for an updated release addressing the keyword parameter handling in wangkan_list.php.

Workarounds

Deploy WAF rules to block SQL metacharacters in the keyword query parameter on the affected endpoint.
Apply a virtual patch that validates the keyword value against an alphanumeric allowlist before the request reaches wangkan_list.php.
Reduce the database account privileges used by ZZCMS to limit the impact of a successful injection, removing rights such as FILE, DROP, and cross-database SELECT.

bash

# Example nginx rule to block suspicious keyword values on the affected endpoint
location = /admin/wangkan_list.php {
    if ($arg_keyword ~* "(union|select|insert|update|delete|--|/\*|;|0x)") {
        return 403;
    }
    # proxy_pass or fastcgi_pass directives follow
}