CVE-2025-2117: Founder All-Media System SQLi Vulnerability

CVE-2025-2117 Overview

CVE-2025-2117 is a SQL injection vulnerability in Beijing Founder Electronics Founder Enjoys All-Media Acquisition and Editing System 3.0. The flaw resides in the electricDocList function of the /newsedit/report/reportCenter.do endpoint. Attackers can manipulate the fvID and catID parameters to inject arbitrary SQL statements. The vulnerability is exploitable remotely over the network with low privileges required. Public disclosure of the exploit technique has occurred, and the vendor did not respond to disclosure attempts. The weakness is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Remote attackers with low-level authentication can inject arbitrary SQL queries through the fvID or catID parameters, potentially exposing or modifying data stored in the backend database.

Affected Products

Beijing Founder Electronics Founder Enjoys All-Media Acquisition and Editing System 3.0
Vulnerable endpoint: /newsedit/report/reportCenter.do
Vulnerable function: electricDocList

Discovery Timeline

2025-03-09 - CVE-2025-2117 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2117

Vulnerability Analysis

The vulnerability affects the reporting subsystem of the Founder Enjoys All-Media Acquisition and Editing System. When the application processes requests to /newsedit/report/reportCenter.do, the electricDocList function accepts user-supplied values for the fvID and catID parameters. These parameters flow directly into a backend SQL query without proper sanitization or parameterization. Attackers with basic authenticated access can craft malicious input that alters the query logic. This enables extraction of sensitive database records, modification of stored content, or enumeration of the underlying database schema. The exploit technique has been publicly disclosed through VulDB submission #508302, increasing the likelihood of opportunistic exploitation.

Root Cause

The root cause is improper neutralization of special elements in a downstream component [CWE-74]. The electricDocList function concatenates the fvID and catID HTTP parameters directly into SQL statements. The application does not use prepared statements or parameterized queries, and it does not validate the parameter types before query construction. Any single-quote, comment marker, or SQL keyword supplied by a client reaches the database interpreter unchanged.

Attack Vector

Exploitation requires network access to the media acquisition and editing application and low-privileged credentials. An attacker sends a crafted HTTP request to /newsedit/report/reportCenter.do with malicious payloads in the fvID or catID parameters. Because the parameters accept arbitrary SQL fragments, adversaries can perform union-based, boolean-based, or time-based blind SQL injection. Common outcomes include database credential theft, session token disclosure, and lateral pivoting into other backend systems.

No verified proof-of-concept code has been published in a security research repository. Technical details are referenced in the VulDB entry #299012 and the associated VulDB submission #508302.

Detection Methods for CVE-2025-2117

Indicators of Compromise

HTTP requests to /newsedit/report/reportCenter.do containing SQL metacharacters (single quotes, --, UNION, SLEEP, BENCHMARK) in the fvID or catID query parameters.
Database logs showing unexpected UNION SELECT, INFORMATION_SCHEMA queries, or errors originating from the reporting module.
Abnormal response times from the reportCenter.do endpoint indicative of time-based blind SQL injection.

Detection Strategies

Deploy web application firewall rules that flag SQL injection payloads targeting the fvID and catID parameters on the reporting endpoint.
Correlate authentication logs with anomalous request patterns from low-privilege accounts accessing /newsedit/report/reportCenter.do.
Monitor database query logs for statements referencing system tables or performing schema enumeration from the application's service account.

Monitoring Recommendations

Enable verbose HTTP request logging for the /newsedit/report/ path and forward logs to a centralized analytics platform.
Alert on repeated 500-level responses from reportCenter.do, which often indicate injection probing.
Track outbound network connections from the application server to detect data exfiltration following successful injection.

How to Mitigate CVE-2025-2117

Immediate Actions Required

Restrict network access to /newsedit/report/reportCenter.do via network segmentation or reverse-proxy allow-lists until a patch is available.
Enforce least-privilege database accounts so that the application user cannot access system tables or write to sensitive schemas.
Rotate credentials stored in the backend database if evidence of exploitation is observed.

Patch Information

No vendor patch has been published. According to the VulDB advisory, Beijing Founder Electronics was contacted early about this disclosure but did not respond. Organizations running the Founder Enjoys All-Media Acquisition and Editing System 3.0 should treat the deployment as unsupported for this issue and rely on compensating controls. Track future updates at VulDB CTI Report #299012.

Workarounds

Place a web application firewall in front of the application and block requests containing SQL metacharacters in the fvID and catID parameters.
Disable or restrict the reporting module for users who do not require it.
Require multi-factor authentication for any account with access to the reporting subsystem to raise the bar for attackers who obtain low-privilege credentials.