CVE-2025-1464: Baiyi Cloud Asset Management SQL Injection

CVE-2025-1464 Overview

A critical SQL injection vulnerability has been identified in Baiyi Cloud Asset Management System up to version 20250204. This vulnerability affects the file /wuser/admin.house.collect.php where improper handling of the project_id parameter allows attackers to inject malicious SQL queries. The attack can be initiated remotely without authentication, potentially compromising the underlying database and sensitive asset management data.

Critical Impact

Remote attackers can exploit this SQL injection vulnerability to extract sensitive data, modify database contents, or potentially gain unauthorized access to the underlying system through the vulnerable project_id parameter.

Affected Products

• Baiyi Cloud Asset Management System up to version 20250204

Discovery Timeline

• 2025-02-19 - CVE-2025-1464 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-1464

Vulnerability Analysis

This vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), specifically manifesting as an SQL injection flaw. The vulnerable endpoint /wuser/admin.house.collect.php fails to properly sanitize user-supplied input in the project_id parameter before incorporating it into SQL queries.

The network-accessible nature of this vulnerability means attackers can exploit it remotely without requiring any prior authentication or user interaction. Successful exploitation could result in unauthorized data access, data modification, or further system compromise depending on the database privileges of the application.

The vendor was contacted about this vulnerability but did not respond, and the exploit details have been publicly disclosed, increasing the urgency for affected organizations to implement protective measures.

Root Cause

The root cause of this vulnerability lies in insufficient input validation and lack of parameterized queries in the admin.house.collect.php file. The project_id parameter is directly concatenated into SQL statements without proper sanitization or escaping, allowing attackers to break out of the intended query structure and inject arbitrary SQL commands.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can craft malicious HTTP requests targeting the /wuser/admin.house.collect.php endpoint with specially crafted project_id parameter values containing SQL injection payloads. This allows the attacker to manipulate database queries executed by the application.

The vulnerability exploitation flow typically involves:

1. Identifying the vulnerable endpoint and parameter
2. Crafting SQL injection payloads to test for vulnerability confirmation
3. Extracting database schema information through error-based or blind SQL injection techniques
4. Exfiltrating sensitive data or modifying database records

For technical details on the exploitation methodology, refer to the GitHub CVE Issue Discussion.

Detection Methods for CVE-2025-1464

Indicators of Compromise

• Unusual SQL error messages in web application logs originating from /wuser/admin.house.collect.php
• HTTP requests to admin.house.collect.php containing SQL-specific characters in the project_id parameter (e.g., single quotes, UNION, SELECT, OR statements)
• Database query logs showing unexpected or malformed queries from the asset management application
• Anomalous database read patterns or data exfiltration indicators

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block SQL injection patterns in the project_id parameter
• Deploy intrusion detection systems (IDS) with signatures for common SQL injection attack payloads
• Enable detailed logging on the web server and database to capture suspicious query activity
• Monitor for reconnaissance activity targeting the /wuser/ directory structure

Monitoring Recommendations

• Configure real-time alerting for SQL syntax errors in application logs associated with the vulnerable endpoint
• Implement database activity monitoring to detect unusual query patterns or privilege escalation attempts
• Monitor network traffic for large data transfers from the database server that could indicate data exfiltration
• Review access logs for repeated requests to admin.house.collect.php from unusual source IPs

How to Mitigate CVE-2025-1464

Immediate Actions Required

• Block external access to the /wuser/admin.house.collect.php endpoint using firewall rules or web server configuration
• Implement input validation on the project_id parameter to accept only numeric values
• Deploy a web application firewall with SQL injection protection rules enabled
• Consider taking the vulnerable application offline if it contains sensitive data and no patch is available

Patch Information

No official patch has been released by the vendor. The vendor was contacted about this disclosure but did not respond. Organizations using Baiyi Cloud Asset Management System should implement the workarounds below and monitor vendor communications for future security updates.

For additional vulnerability details, refer to VulDB #296237.

Workarounds

• Implement parameterized queries or prepared statements in the vulnerable PHP file to prevent SQL injection
• Add input validation to ensure project_id only accepts expected numeric values
• Restrict network access to the application to trusted IP ranges only using firewall rules
• Deploy a reverse proxy with SQL injection filtering capabilities in front of the application

# Example: Block access to vulnerable endpoint via Apache .htaccess
<Files "admin.house.collect.php">
    Order Deny,Allow
    Deny from all
    Allow from 10.0.0.0/8
    Allow from 192.168.0.0/16
</Files>