CVE-2025-22214: Landray EIS SQL Injection Vulnerability

CVE-2025-22214 Overview

CVE-2025-22214 is a SQL injection vulnerability [CWE-89] in Landray Enterprise Information System (EIS) versions 2001 through 2006. The flaw resides in the Message/fi_message_receiver.aspx endpoint, where the replyid parameter is passed to backend database queries without proper sanitization. An authenticated attacker can manipulate the replyid parameter to inject arbitrary SQL statements and read data from the underlying database.

Critical Impact
Authenticated attackers can extract confidential data from the Landray EIS database by injecting crafted SQL through the replyid request parameter.

Affected Products

Landray EIS 2001
Landray EIS versions 2002 through 2005
Landray EIS 2006

Discovery Timeline

2025-01-02 - CVE-2025-22214 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22214

Vulnerability Analysis

The vulnerability affects the Message/fi_message_receiver.aspx handler in Landray EIS. The replyid query string parameter flows directly into a SQL statement that is executed against the application database. Because the parameter is neither validated nor bound as a typed query parameter, an attacker can break out of the intended query context and append arbitrary SQL.

Exploitation requires network access to the web application and low-privileged authenticated access. The impact is limited to confidentiality of database contents, with no direct integrity or availability effect according to the published CVSS vector. Successful exploitation allows the attacker to enumerate database schemas, dump user records, or exfiltrate stored business messages.

Technical proof-of-concept details are published in a public GitHub CVE Analysis repository.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. The replyid parameter is concatenated into a dynamic SQL query in fi_message_receiver.aspx rather than being passed through a parameterized query or prepared statement.

Attack Vector

An attacker authenticates to the Landray EIS web interface and issues an HTTP request to Message/fi_message_receiver.aspx with a manipulated replyid value. The injected payload can include boolean-based, error-based, or time-based SQL injection techniques. Automated tooling such as sqlmap can enumerate the vulnerable parameter and extract database contents.

The vulnerability manifests when user-supplied replyid input reaches the SQL execution layer without sanitization. See the referenced public analysis for request/response evidence and payload construction.

Detection Methods for CVE-2025-22214

Indicators of Compromise

HTTP requests to Message/fi_message_receiver.aspx containing SQL metacharacters such as single quotes, UNION SELECT, WAITFOR DELAY, or -- in the replyid parameter.
Unusually long or URL-encoded replyid values in web server access logs.
Database error messages returned to clients originating from the messaging module.

Detection Strategies

Deploy web application firewall (WAF) signatures that inspect the replyid parameter for SQL injection patterns.
Enable database query logging and alert on unexpected UNION, SELECT from system tables, or long-running queries initiated by the EIS application account.
Correlate authenticated user sessions with anomalous request volume against fi_message_receiver.aspx.

Monitoring Recommendations

Baseline normal parameter values for Message/fi_message_receiver.aspx and alert on deviations.
Monitor authentication logs for low-privilege accounts issuing high-frequency requests against messaging endpoints.
Retain IIS or reverse-proxy logs long enough to support retrospective hunting for SQL injection payloads.

How to Mitigate CVE-2025-22214

Immediate Actions Required

Restrict network access to the Landray EIS management interface to trusted internal networks or VPN users only.
Review web server logs for suspicious requests against Message/fi_message_receiver.aspx and rotate credentials of any accounts observed issuing such requests.
Enforce least privilege on the database account used by the EIS application to limit data exposure.

Patch Information

No vendor advisory or fixed version is referenced in the published CVE data. Contact Landray support for remediation guidance and monitor vendor channels for an official patch covering EIS versions 2001 through 2006.

Workarounds

Place a WAF in front of the EIS application and block requests where replyid contains SQL metacharacters or non-numeric input.
Constrain the database service account to read-only access on non-messaging tables to reduce the scope of successful injection.
Disable or firewall the Message/fi_message_receiver.aspx endpoint if the messaging feature is not required.

bash

# Example WAF rule (ModSecurity) blocking non-numeric replyid values
SecRule ARGS:replyid "!@rx ^[0-9]+$" \
    "id:1002214,phase:2,deny,status:403,\
     msg:'CVE-2025-22214: non-numeric replyid blocked'"