CVE-2025-15169: Biggidroid Simple PHP CMS SQL Injection

CVE-2025-15169 Overview

CVE-2025-15169 is a SQL injection vulnerability in BiggiDroid Simple PHP CMS 1.0. The flaw resides in the /admin/editsite.php script, where the ID parameter is not properly sanitized before being concatenated into a SQL query. Authenticated remote attackers can manipulate the ID argument to inject arbitrary SQL syntax and influence backend database operations. A public exploit has been disclosed, and the vendor did not respond to the disclosure attempt. The weakness is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-74 (Injection).

Critical Impact
An authenticated remote attacker can manipulate the ID parameter in /admin/editsite.php to execute arbitrary SQL statements against the application database.

Affected Products

BiggiDroid Simple PHP CMS 1.0
CPE: cpe:2.3:a:biggidroid:simple_php_cms:1.0:*:*:*:*:*:*:*
Component: biggidroid:simple_php_cms

Discovery Timeline

2025-12-29 - CVE-2025-15169 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-15169

Vulnerability Analysis

The vulnerability is a SQL injection flaw in the administrative interface of BiggiDroid Simple PHP CMS 1.0. The affected endpoint /admin/editsite.php accepts an ID request parameter that is interpolated into a SQL statement without parameterization or input validation. An attacker who already holds administrative credentials can supply crafted values for ID that break out of the intended query context.

Successful exploitation can lead to disclosure, modification, or deletion of records stored in the underlying database. Depending on database privileges, secondary impacts such as authentication bypass or persistence within the CMS may also be possible. The exploit has been publicly disclosed, lowering the barrier for opportunistic abuse.

Root Cause

The root cause is improper neutralization of user-supplied input in a SQL statement ([CWE-89]). The editsite.php administrative script trusts the ID parameter and embeds it directly into a database query rather than using prepared statements or parameter binding.

Attack Vector

The attack is performed remotely over the network against the /admin/editsite.php endpoint. The CVSS 4.0 vector indicates that high privileges are required, meaning the attacker must be authenticated to the admin interface. No user interaction is needed, and attack complexity is low. The vendor was contacted but did not respond, and no patch is currently available.

No verified proof-of-concept code is available in the enriched data set. Refer to the Gitee Issue Report and VulDB entry #338549 for technical exploitation details.

Detection Methods for CVE-2025-15169

Indicators of Compromise

HTTP requests to /admin/editsite.php containing SQL meta-characters in the ID parameter, such as single quotes, UNION, SELECT, --, or OR 1=1.
Unexpected database errors logged from the Simple PHP CMS application that reference syntax errors near the ID value.
Administrative sessions originating from unusual IP addresses or geographies issuing repeated requests to editsite.php.

Detection Strategies

Inspect web server access logs for query strings to /admin/editsite.php where ID deviates from expected numeric values.
Deploy a web application firewall (WAF) signature for SQL injection patterns targeting the ID parameter on the admin path.
Correlate authentication events with subsequent requests to editsite.php to identify compromised admin accounts being used for injection.

Monitoring Recommendations

Enable verbose query logging on the database backing Simple PHP CMS and alert on malformed statements referencing the editsite workflow.
Monitor for new or modified admin accounts and content rows created shortly after suspicious editsite.php traffic.
Track outbound connections from the CMS host that could indicate data exfiltration following a successful injection.

How to Mitigate CVE-2025-15169

Immediate Actions Required

Restrict network access to /admin/ paths to trusted management IP ranges through firewall or reverse-proxy rules.
Rotate all administrator credentials and enforce strong, unique passwords for the CMS admin interface.
Audit the database for unauthorized changes to site configuration, user, and content tables.

Patch Information

No vendor patch is available. According to the disclosure, BiggiDroid did not respond to outreach about CVE-2025-15169. Organizations should consider migrating away from Simple PHP CMS 1.0 until a maintained release addresses the issue. Track VulDB CTI #338549 for updates.

Workarounds

Place the CMS behind a WAF with rules that block SQL injection payloads targeting the ID parameter on editsite.php.
Apply a local source-code fix to editsite.php that validates ID as an integer and uses prepared statements with bound parameters.
Disable or remove the editsite.php endpoint if site editing through that interface is not required.

bash

# Example nginx rule to block non-numeric ID values on editsite.php
location = /admin/editsite.php {
    if ($arg_ID !~ "^[0-9]+$") { return 403; }
    # forward to PHP-FPM as usual
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}