CVE-2025-32389: NamelessMC SQL Injection Vulnerability

CVE-2025-32389 Overview

NamelessMC is a free, open-source website platform used by Minecraft server operators to manage community sites, user accounts, and forums. A SQL injection vulnerability [CWE-89] affects NamelessMC versions prior to 2.1.4. The flaw allows attackers to inject SQL through unexpected square bracket GET parameter syntax, which PHP parses as arrays via $_GET['param']. An authenticated attacker with low privileges can exploit this over the network to compromise database confidentiality and integrity. The maintainers patched the issue in version 2.1.4.

Critical Impact
Low-privileged attackers can execute arbitrary SQL queries against the NamelessMC database, exposing user credentials, personal data, and site configuration.

Affected Products

NamelessMC Nameless versions prior to 2.1.4
All PHP-based deployments using the vulnerable DB.php database wrapper
Minecraft community sites running unpatched NamelessMC installations

Discovery Timeline

2025-04-18 - CVE-2025-32389 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32389

Vulnerability Analysis

The vulnerability resides in the where_clauses handling logic inside core/classes/Database/DB.php. NamelessMC accepted GET parameters formatted with square bracket syntax such as ?param[0]=a¶m[1]=b. PHP automatically converts this input into an array assigned to $_GET['param']. The database layer iterated over the clauses but silently skipped values that were not arrays, allowing attacker-controlled structures to reach SQL construction paths without proper validation. Because low-privileged authenticated users can submit crafted requests, they can manipulate query construction and inject arbitrary SQL statements.

Root Cause

The root cause is improper input validation in the query builder. The original code used continue when a clause was not an array, silently discarding malformed input rather than rejecting the request. Combined with PHP's implicit array parsing of bracketed query parameters, this allowed attacker-supplied arrays to bypass expected type checks and reach SQL string assembly.

Attack Vector

An authenticated attacker sends an HTTP request with parameters using bracket notation. PHP transforms these into arrays that the vulnerable database wrapper processes. The attacker controls the array contents, which are incorporated into WHERE clause construction, resulting in SQL injection against the backend database.

php

         $where_clauses = [];
         foreach ($clauses as $clause) {
             if (!is_array($clause)) {
-                continue;
+                throw new InvalidArgumentException('Where clause must be an array');
             }
 
             if (count($clause) !== count($clause, COUNT_RECURSIVE)) {

Source: NamelessMC patch commit 02c81c7. The fix replaces silent continue behavior with an explicit InvalidArgumentException, rejecting non-array clauses outright.

Detection Methods for CVE-2025-32389

Indicators of Compromise

HTTP requests containing bracket-notation GET parameters such as ?id[0]= or ?user[1]= directed at NamelessMC endpoints
Web server access logs showing SQL keywords (UNION, SELECT, SLEEP, INFORMATION_SCHEMA) inside array parameter values
Database error entries referencing malformed WHERE clause syntax originating from NamelessMC application queries
Unexpected read access to nl2_users or credential tables from application service accounts

Detection Strategies

Deploy web application firewall rules that inspect URL-encoded array parameters for SQL metacharacters and syntax
Enable database query logging and alert on abnormal query patterns originating from the NamelessMC PHP process
Baseline expected NamelessMC parameter names and flag deviations that use bracket array syntax on endpoints that do not require it

Monitoring Recommendations

Aggregate NamelessMC web logs into a centralized log platform for pattern analysis and long-term retention
Monitor authentication tables for unauthorized session tokens, password hash reads, or privilege changes
Track outbound connections from the web server to detect data exfiltration following successful injection

How to Mitigate CVE-2025-32389

Immediate Actions Required

Upgrade NamelessMC to version 2.1.4 or later immediately using the GitHub Release v2.1.4
Audit database logs for suspicious query patterns dated before the upgrade to identify prior exploitation attempts
Rotate database credentials, API keys, and administrative account passwords if compromise is suspected
Review user accounts for unauthorized privilege escalations or newly created administrator entries

Patch Information

The fix is available in NamelessMC 2.1.4. Review the GitHub Security Advisory GHSA-5984-mhcp-cq2x and the corresponding patch commit for implementation details.

Workarounds

Restrict NamelessMC access to trusted networks or VPN users until patching is complete
Configure a web application firewall to block requests containing bracket-notation array parameters on sensitive endpoints
Reduce authenticated user privileges within NamelessMC to limit the exploitation surface for low-privileged accounts

bash

# Upgrade NamelessMC to patched version
cd /var/www/nameless
git fetch --tags
git checkout v2.1.4
php core/includes/updater.php