CVE-2025-2132: Ftcms 2.1 SQL Injection Vulnerability

CVE-2025-2132 Overview

CVE-2025-2132 is a SQL injection vulnerability in ftcms version 2.1. The flaw resides in an unspecified function within the /admin/index.php/web/ajax_all_lists endpoint of the Search component. Attackers can manipulate the name argument to inject arbitrary SQL statements into the underlying database query. The vulnerability is exploitable remotely over the network, though it requires high privileges to reach the affected administrative endpoint. The exploit has been publicly disclosed, increasing the risk of opportunistic abuse. The vendor was contacted prior to disclosure but did not respond, leaving the issue unaddressed at the time of publication.

Critical Impact
Authenticated attackers can manipulate the name parameter in /admin/index.php/web/ajax_all_lists to execute arbitrary SQL queries, exposing or modifying database contents.

Affected Products

ftcms 2.1
Component: Search functionality (/admin/index.php/web/ajax_all_lists)
Parameter: name

Discovery Timeline

2025-03-09 - CVE-2025-2132 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2132

Vulnerability Analysis

The vulnerability is classified under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command and [CWE-74] Improper Neutralization of Special Elements in Output Used by a Downstream Component. The defect lies in how the ajax_all_lists handler processes the name request parameter. User-supplied input is concatenated into a SQL query without proper sanitization or parameterized binding.

An attacker with administrative access can send a crafted request containing SQL metacharacters in the name field. The injected payload alters the query logic executed by the database engine. This can lead to disclosure of database records, modification of stored data, or further interaction with the database server.

The attack vector is network-based, and exploitation does not require user interaction. Public disclosure of the exploit raises the likelihood of automated scanning against exposed ftcms 2.1 installations.

Root Cause

The root cause is missing input validation and the absence of prepared statements in the ajax_all_lists handler. The name parameter is incorporated into a SQL statement through string concatenation, allowing attacker-controlled syntax to alter the query.

Attack Vector

An attacker authenticated to the ftcms administrative interface issues an HTTP request to /admin/index.php/web/ajax_all_lists with a malicious name parameter. The unsanitized value is appended to a backend SQL query. The database executes the modified statement, returning data or performing operations the attacker specifies. See the GitHub Issue Report for proof-of-concept details.

Detection Methods for CVE-2025-2132

Indicators of Compromise

HTTP requests to /admin/index.php/web/ajax_all_lists containing SQL syntax such as UNION SELECT, OR 1=1, SLEEP(, or comment sequences (--, #) in the name parameter.
Web server access logs showing unusually long or URL-encoded name parameter values targeting the admin endpoint.
Database error messages logged after requests to the ajax_all_lists path, indicating malformed query execution.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the name parameter on the /admin/index.php/web/ajax_all_lists route for SQL injection patterns.
Enable database query auditing to flag unexpected UNION, INFORMATION_SCHEMA, or time-delay functions originating from the ftcms application user.
Correlate authentication logs with administrative endpoint access to identify abuse from compromised admin accounts.

Monitoring Recommendations

Forward ftcms application logs and web server logs to a centralized analytics platform for query-pattern analysis.
Alert on spikes in 500-series HTTP responses from the ftcms admin interface, which can indicate failed injection attempts.
Monitor outbound database traffic for anomalous result sizes that may indicate data exfiltration through injected queries.

How to Mitigate CVE-2025-2132

Immediate Actions Required

Restrict access to the ftcms /admin/ interface to trusted IP addresses through network ACLs or VPN gating.
Enforce strong, unique credentials and multi-factor authentication on all administrative accounts to limit privileged access.
Audit recent admin-endpoint traffic for evidence of exploitation attempts against the name parameter.

Patch Information

No vendor patch is available. The ftcms maintainers did not respond to disclosure attempts, as noted in the VulDB advisory. Operators should consider migrating to a maintained CMS or applying a custom fix that replaces concatenated queries with parameterized statements.

Workarounds

Place the administrative interface behind a reverse proxy with WAF rules that block SQL metacharacters in the name parameter.
Apply a virtual patch in the WAF or application gateway to drop requests to /admin/index.php/web/ajax_all_lists containing suspicious SQL syntax.
Restrict the database account used by ftcms to least-privilege permissions, removing rights to modify schema or read unrelated tables.
If a custom code fix is feasible, replace string-concatenated queries with prepared statements using bound parameters.

bash

# Example nginx rule to block SQL syntax in the vulnerable parameter
location /admin/index.php/web/ajax_all_lists {
    if ($arg_name ~* "(union|select|sleep\(|--|#|or\s+1=1)") {
        return 403;
    }
    proxy_pass http://ftcms_backend;
}