CVE-2025-25222: Luxsoft Luxcal Web Calendar SQLi Flaw

CVE-2025-25222 Overview

CVE-2025-25222 is a SQL injection vulnerability in LuxCal Web Calendar affecting the retrieve.php script. The flaw exists in versions prior to 5.3.3M (MySQL build) and prior to 5.3.3L (SQLite build). Attackers can exploit the issue remotely without authentication or user interaction to delete, alter, or retrieve database records. The vulnerability is classified under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Unauthenticated remote attackers can manipulate database queries through retrieve.php, exposing or destroying calendar data, user records, and other application content.

Affected Products

Luxsoft LuxCal Web Calendar (MySQL) prior to 5.3.3M
Luxsoft LuxCal Web Calendar (SQLite) prior to 5.3.3L
Deployments exposing retrieve.php to the network

Discovery Timeline

2025-02-18 - CVE-2025-25222 published to NVD
2025-09-15 - Last updated in NVD database

Technical Details for CVE-2025-25222

Vulnerability Analysis

The vulnerability resides in retrieve.php, a server-side component of the LuxCal Web Calendar. The script accepts user-supplied input that is concatenated into SQL queries without proper sanitization or parameterization. Both the MySQL and SQLite editions of the product are affected by the same flaw, indicating that the vulnerable query construction is shared across database backends.

A remote attacker can send crafted HTTP requests containing SQL metacharacters to the retrieve.php endpoint. The injected payload becomes part of the executed query, allowing the attacker to alter the intended SQL logic. Successful exploitation provides full read, write, and delete access to data managed by the calendar application.

Root Cause

The root cause is improper neutralization of user-controlled input passed into SQL statements. The application does not use prepared statements or parameter binding when constructing queries inside retrieve.php. Special characters such as single quotes, comments, and UNION keywords pass directly into the database engine.

Attack Vector

Exploitation is performed over the network against any reachable instance of the LuxCal Web Calendar. No authentication is required, and the attack does not need user interaction. An attacker sends an HTTP request with a malicious parameter value to retrieve.php. The crafted input is appended to a backend SQL query and executed, yielding data extraction, modification, or deletion. The vulnerability mechanics are documented in the JVN Security Advisory and discussed in the Luxsoft Forum Discussion.

Detection Methods for CVE-2025-25222

Indicators of Compromise

HTTP requests to retrieve.php containing SQL metacharacters such as ', --, UNION SELECT, OR 1=1, or information_schema references.
Web server access logs showing repeated requests to retrieve.php with unusually long query strings or encoded payloads.
Database error messages referencing syntax errors originating from retrieve.php requests.
Unexpected modification or deletion of LuxCal calendar entries, user accounts, or configuration tables.

Detection Strategies

Inspect web server access and error logs for anomalous parameter values targeting retrieve.php.
Deploy a Web Application Firewall (WAF) rule set tuned to detect SQL injection patterns against the LuxCal URL path.
Enable database query logging and alert on queries that contain stacked statements or schema enumeration keywords.

Monitoring Recommendations

Forward web server, application, and database logs to a centralized analytics platform for correlation across request, query, and outcome.
Track baseline request rates and parameter shapes for retrieve.php so deviations trigger investigation.
Monitor outbound network traffic from the web server for data exfiltration attempts that may follow a successful injection.

How to Mitigate CVE-2025-25222

Immediate Actions Required

Upgrade to LuxCal Web Calendar 5.3.3M (MySQL) or 5.3.3L (SQLite) or later from the Luxsoft Download Page.
Restrict network access to the calendar application until the patch is applied, using IP allowlists or VPN-only access.
Review web server and database logs for evidence of prior exploitation against retrieve.php.

Patch Information

Luxsoft has released fixed builds: version 5.3.3M for the MySQL edition and 5.3.3L for the SQLite edition. Administrators should download the updated package from the vendor and follow the upgrade instructions provided in the Luxsoft Forum Discussion. Verify the application version after upgrade to confirm the fix is in place.

Workarounds

Block external access to retrieve.php at the reverse proxy or WAF layer until patching is complete.
Apply WAF signatures that detect and block SQL injection payloads targeting the LuxCal request parameters.
Enforce least-privilege database accounts so the calendar application cannot drop tables or read unrelated schemas.

bash

# Example nginx rule to block requests with common SQLi patterns against retrieve.php
location ~* /retrieve\.php$ {
    if ($args ~* "(union(.*)select|information_schema|--|';|/\*)") {
        return 403;
    }
}