CVE-2025-25991: Hoosk CMS SQL Injection Vulnerability

CVE-2025-25991 Overview

CVE-2025-25991 is a SQL injection vulnerability in Hoosk CMS version 1.7.1. The flaw resides in the /install/index.php component and allows an attacker to inject crafted SQL statements into database queries. Successful exploitation exposes sensitive information stored in the underlying database. The weakness maps to [CWE-89], improper neutralization of special elements used in an SQL command. Hoosk is an open-source PHP-based content management system maintained on GitHub, and the affected installation script is reachable during or after the initial setup workflow.

Critical Impact
Attackers with local access to the installer endpoint can extract database contents through crafted input to /install/index.php, leading to disclosure of configuration data, credentials, or content stored in the Hoosk database.

Affected Products

Hoosk CMS version 1.7.1
CPE: cpe:2.3:a:hoosk:hoosk:1.7.1:*:*:*:*:*:*:*
Deployments exposing /install/index.php after installation

Discovery Timeline

2025-02-14 - CVE-2025-25991 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-25991

Vulnerability Analysis

The vulnerability exists in the Hoosk installation script located at /install/index.php. User-controlled input passed to this component is concatenated into SQL statements without proper parameterization or sanitization. An attacker who can reach the installer endpoint can inject SQL syntax that alters the intended query logic. The result is unauthorized read access to database contents accessible from the installer's database context. Because the installer typically operates with privileged database credentials to create tables and seed data, the disclosure scope can include the full application schema.

Root Cause

The root cause is unsanitized input handling within the installation routine in /install/index.php. The code path constructs SQL queries through string concatenation rather than prepared statements with bound parameters. Hoosk 1.7.1 does not remove or restrict the installer once setup completes, leaving the vulnerable endpoint reachable on production deployments. This behavior is consistent with the [CWE-89] classification for SQL injection.

Attack Vector

The attack vector is local, as reflected in the CVSS vector. Exploitation does not require authentication or user interaction. An attacker submits crafted parameters to /install/index.php, and the injected clauses execute against the configured database. The impact is limited to confidentiality and integrity of data reachable through the installer's SQL context; the CVSS vector reports no direct availability impact. Additional technical context is available in the Hoosk GitHub Issue Discussion. No public proof-of-concept exploit or entry in the CISA Known Exploited Vulnerabilities catalog is listed for this CVE.

Detection Methods for CVE-2025-25991

Indicators of Compromise

Unexpected HTTP requests to /install/index.php on production Hoosk deployments after installation completed
Query strings or POST bodies to the installer containing SQL metacharacters such as ', --, UNION SELECT, or INFORMATION_SCHEMA
Web server access logs showing repeated installer requests from a single source address
Database error messages returned in HTTP responses referencing MySQL syntax errors originating from installer routes

Detection Strategies

Deploy web application firewall rules that block SQL injection patterns targeting /install/* paths in Hoosk deployments
Correlate web server logs for any access to /install/index.php after the initial deployment window and alert on matches
Inspect database audit logs for queries originating from the web application user that reference information_schema or system tables

Monitoring Recommendations

Enable verbose logging on the web server for the /install/ directory and forward events to a centralized log platform
Monitor for anomalous outbound data volumes from the Hoosk web host, which can indicate bulk exfiltration through the injection
Track file-integrity changes on install/index.php and adjacent installer files to identify tampering

How to Mitigate CVE-2025-25991

Immediate Actions Required

Remove or rename the /install/ directory on all Hoosk deployments once installation completes
Restrict access to /install/index.php at the web server or reverse proxy layer to trusted administrative addresses only
Rotate database credentials configured during Hoosk installation if the installer was reachable from untrusted networks
Review database audit logs for evidence of unauthorized read activity against Hoosk tables

Patch Information

No vendor advisory or fixed release is listed in the enriched CVE data. Refer to the upstream project at the Hoosk GitHub repository for the latest release status and to the GitHub Issue Discussion for maintainer response. Until a patched version is confirmed, operators should treat the installer path as a required post-install cleanup step.

Workarounds

Delete the install directory from the web root immediately after completing Hoosk setup
Add web server access controls (for example, Deny from all in Apache or a location block in nginx) that block requests to /install/
Place the Hoosk application behind a web application firewall configured to block SQL injection payloads
Assign the least-privileged database account required for runtime operation, distinct from the account used during installation

bash

# Example nginx configuration to block access to the Hoosk installer
location ^~ /install/ {
    deny all;
    return 404;
}