CVE-2025-26348 Overview
CVE-2025-26348 is an SQL Injection vulnerability [CWE-89] affecting Q-Free MaxTime version 2.11.0 and earlier. The flaw resides in the maxprofile/menu/model.lua component, specifically in the editUserMenu endpoint. An authenticated remote attacker can send crafted HTTP requests to execute arbitrary SQL commands against the backend database. The vulnerability results from improper neutralization of special elements passed to SQL statements. Successful exploitation can compromise data integrity and expose sensitive configuration or user data managed by the MaxTime traffic management platform.
Critical Impact
An authenticated attacker can execute arbitrary SQL commands, modify database contents, and disrupt operations of Q-Free MaxTime traffic management deployments.
Affected Products
- Q-Free MaxTime versions ≤ 2.11.0
- Component: maxprofile/menu/model.lua
- Endpoint: editUserMenu
Discovery Timeline
- 2025-02-12 - CVE-2025-26348 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-26348
Vulnerability Analysis
The vulnerability exists in the editUserMenu endpoint implemented in maxprofile/menu/model.lua. The endpoint accepts user-controlled input from authenticated HTTP requests and concatenates it directly into SQL statements without proper sanitization or parameterization. This violates the neutralization requirement described in [CWE-89].
An authenticated attacker holding low-privilege credentials can craft HTTP request parameters containing SQL metacharacters. The backend then interprets injected fragments as part of the SQL query. Attackers can read arbitrary tables, modify menu configurations, escalate privileges within the application, or corrupt records that MaxTime relies on for traffic operations.
The Nozomi Networks advisory documents the injection path and confirms that authentication is required, which limits pre-auth exposure but does not prevent exploitation from any compromised operator account.
Root Cause
The root cause is dynamic SQL construction using unsanitized inputs in the editUserMenu handler. The Lua model file builds queries by concatenating request parameters into SQL strings rather than using prepared statements or parameter binding. Any input containing single quotes, semicolons, or SQL keywords propagates directly into the executed query.
Attack Vector
The attack vector is network-based and requires an authenticated session. An attacker sends HTTP requests to the editUserMenu endpoint containing malicious SQL payloads inside parameters processed by the model function. The server executes the injected SQL under the privileges of the application database user. See the Nozomi Networks Vulnerability Advisory for technical details on the injection path.
Detection Methods for CVE-2025-26348
Indicators of Compromise
- HTTP requests to editUserMenu containing SQL metacharacters such as ', --, ;, UNION, or SELECT in parameter values
- Unexpected modifications to the MaxTime menu or user configuration tables
- Database error messages returned to authenticated user sessions
- Anomalous authenticated sessions issuing repeated variations of the same request parameters
Detection Strategies
- Inspect web server and application logs for requests targeting maxprofile/menu/model.lua handlers with encoded SQL syntax
- Deploy a web application firewall (WAF) rule set that flags SQL injection patterns on authenticated MaxTime endpoints
- Enable database query logging and alert on unusual query structures originating from the MaxTime application account
Monitoring Recommendations
- Monitor authenticated user activity for privilege changes made through menu editing functions
- Alert on failed SQL statements or syntax errors logged by the MaxTime database backend
- Correlate authentication events with subsequent access to administrative endpoints to detect account takeover chains
How to Mitigate CVE-2025-26348
Immediate Actions Required
- Upgrade Q-Free MaxTime to a version later than 2.11.0 once the vendor publishes a fixed release
- Restrict network access to the MaxTime management interface using firewall rules or VPN gating
- Audit all MaxTime user accounts and remove or rotate credentials for accounts that are unused or shared
Patch Information
Refer to the Nozomi Networks Vulnerability Advisory and coordinate with Q-Free for the availability of a patched release. No vendor advisory URL was published in the NVD record at the time of writing.
Workarounds
- Limit access to the editUserMenu endpoint to trusted administrative networks only
- Enforce least-privilege for the database account used by MaxTime to minimize impact of injected queries
- Deploy an application-layer proxy or WAF configured to block SQL injection payloads on MaxTime HTTP endpoints
- Increase logging verbosity on the MaxTime application and database to support forensic review during remediation
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
