CVE-2025-26346: Q-free Maxtime SQL Injection Vulnerability

CVE-2025-26346 Overview

CVE-2025-26346 is a SQL injection vulnerability [CWE-89] in Q-Free MaxTime traffic management software. The flaw resides in the editUserGroupMenu endpoint within maxprofile/menu/model.lua. An authenticated remote attacker can submit crafted HTTP requests to execute arbitrary SQL commands against the backend database. The vulnerability affects all versions of Q-Free MaxTime up to and including 2.11.0. Successful exploitation can lead to data manipulation, integrity loss, and partial disclosure of sensitive configuration data managed by the application.

Critical Impact
Authenticated attackers can execute arbitrary SQL commands against the MaxTime database, compromising integrity of traffic management data and exposing stored configuration information.

Affected Products

Q-Free MaxTime versions <= 2.11.0
Component: maxprofile/menu/model.lua
Endpoint: editUserGroupMenu

Discovery Timeline

2025-02-12 - CVE-2025-26346 published to NVD
2025-10-24 - Last updated in NVD database

Technical Details for CVE-2025-26346

Vulnerability Analysis

The vulnerability is an Improper Neutralization of Special Elements used in an SQL Command [CWE-89]. The editUserGroupMenu endpoint in maxprofile/menu/model.lua constructs SQL statements using attacker-controlled input without proper sanitization or parameterization. An authenticated user can submit HTTP requests containing crafted parameter values that break out of the intended SQL context. The injected SQL then executes with the database privileges granted to the MaxTime application service account.

Q-Free MaxTime is deployed in transportation and intelligent traffic system (ITS) environments. Database compromise in these environments can affect operational records, user group configuration, and audit data tied to the menu authorization model.

Root Cause

The root cause is the construction of SQL queries through direct string concatenation of user-supplied input within the Lua model layer. The editUserGroupMenu handler does not apply input validation or use prepared statements with bound parameters. Any special SQL metacharacter supplied by the client passes directly into the query executed by the database driver.

Attack Vector

Exploitation requires network access to the MaxTime web interface and valid authenticated credentials at any privilege level. The attacker sends a crafted HTTP request to the editUserGroupMenu endpoint with malicious SQL payloads embedded in vulnerable parameters. No user interaction is required beyond the attacker's own request.

For technical details, refer to the Nozomi Networks Vulnerability Advisory.

Detection Methods for CVE-2025-26346

Indicators of Compromise

HTTP POST or GET requests targeting the editUserGroupMenu endpoint containing SQL metacharacters such as single quotes, UNION, --, or ;.
Unexpected database errors logged by the MaxTime application correlated with requests from authenticated user sessions.
Anomalous modifications to user group or menu permission tables outside of normal administrative workflows.

Detection Strategies

Inspect web server and application logs for requests to maxprofile/menu/model.lua containing encoded or unencoded SQL syntax in parameter values.
Deploy web application firewall rules that flag SQL injection patterns directed at MaxTime endpoints, particularly the menu management routes.
Enable database query logging and alert on unexpected UPDATE, INSERT, or DELETE statements originating from the MaxTime service account.

Monitoring Recommendations

Monitor authentication events for the MaxTime application and correlate sessions with subsequent requests to administrative endpoints.
Track outbound database traffic volume for spikes that may indicate data extraction via blind or time-based SQL injection techniques.
Review user group configuration changes daily and verify they map to approved administrative activity.

How to Mitigate CVE-2025-26346

Immediate Actions Required

Restrict network access to the MaxTime web interface to trusted management networks using firewall rules or VPN gating.
Audit and reduce the number of authenticated MaxTime user accounts, and rotate credentials for any account that may have been exposed.
Apply the principle of least privilege to the database account used by MaxTime so that injected queries cannot reach administrative database functions.

Patch Information

Review the Nozomi Networks Vulnerability Advisory and contact Q-Free for a fixed version beyond 2.11.0. Apply vendor-supplied updates as soon as they are available and validated in a staging environment.

Workarounds

Place a web application firewall in front of MaxTime configured to block SQL injection patterns on requests to maxprofile/menu/model.lua.
Disable or restrict access to the editUserGroupMenu endpoint at the reverse proxy layer for non-administrative users.
Enable database-side query auditing and configure read-only roles where write access is not required by the application workflow.

bash

# Example nginx reverse proxy rule to restrict editUserGroupMenu to admin IPs
location ~ /maxprofile/menu/model\.lua {
    allow 10.0.0.0/24;   # admin management subnet
    deny  all;
    proxy_pass http://maxtime_backend;
}