CVE-2025-3318: Kennifrog Financial Management SQL Injection

CVE-2025-3318 Overview

CVE-2025-3318 is a SQL injection vulnerability in the Kennifrog Company Financial Management System (公司财务管理系统) version 1.0. The flaw resides in the page function of src/main/java/com/controller/ShangpinleixingController.java, where the sort parameter is not properly sanitized before use in a database query [CWE-89]. Attackers can exploit this issue remotely over the network with low privileges and no user interaction. The exploit has been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed instances.

Critical Impact
Remote authenticated attackers can inject arbitrary SQL statements through the sort parameter, potentially exposing or modifying financial data stored in the application database.

Affected Products

Kennifrog Company Financial Management System 1.0
Vendor uses rolling releases; specific fixed version details are not published
Component: ShangpinleixingController.java (page function)

Discovery Timeline

2025-04-06 - CVE-2025-3318 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3318

Vulnerability Analysis

The vulnerability is a classic SQL injection [CWE-89], a subclass of improper neutralization of special elements in output used by a downstream component [CWE-74]. The page handler in ShangpinleixingController.java accepts a sort request parameter and passes it into a database query without adequate validation or parameterization. An attacker can supply crafted SQL fragments through this parameter, altering the query logic executed by the backend database.

Because the vulnerable endpoint is exposed over HTTP and requires only low privileges, exploitation can be attempted by any authenticated user of the application. The impact spans confidentiality, integrity, and availability of the underlying financial data.

Root Cause

The root cause is the direct concatenation of user-controlled input into a SQL statement, likely within an ORDER BY clause where prepared-statement placeholders cannot be used for identifiers. Without an allowlist of permitted sort columns, the application evaluates attacker-controlled SQL syntax at query time.

Attack Vector

Exploitation requires sending an HTTP request to the vulnerable controller endpoint with a malicious value in the sort query parameter. The attacker uses this input channel to append conditions, UNION selects, or stacked statements depending on the database engine. No user interaction is required, and the attack can be performed remotely.

No verified proof-of-concept code has been published. Technical details are available in the Gitee Issue Discussion and the VulDB entry #303517.

Detection Methods for CVE-2025-3318

Indicators of Compromise

HTTP requests to endpoints served by ShangpinleixingController containing SQL keywords such as UNION, SELECT, SLEEP, or comment sequences (--, /*) in the sort parameter.
Unexpected database errors, long-running queries, or time-based delays correlated with requests to the shangpinleixing paths.
Application log entries showing unusual sort values that do not correspond to valid column names.

Detection Strategies

Deploy a web application firewall (WAF) rule that inspects the sort parameter for SQL metacharacters and known injection payload patterns.
Enable database query auditing to flag queries with syntactically anomalous ORDER BY clauses or unexpected UNION operators.
Correlate authentication logs with the origin of suspicious query parameter values to identify compromised accounts.

Monitoring Recommendations

Baseline the normal set of sort values submitted by legitimate clients and alert on deviations.
Monitor outbound traffic from the application server for exfiltration patterns following suspicious requests.
Track error-rate spikes on the financial management application, which often accompany blind SQL injection probing.

How to Mitigate CVE-2025-3318

Immediate Actions Required

Restrict network access to the Company Financial Management System to trusted internal users through firewall or VPN controls.
Rotate credentials of any accounts that could reach the vulnerable endpoint and review recent access logs for abuse.
Enable a WAF policy that blocks SQL metacharacters in the sort parameter until an upstream fix is deployed.

Patch Information

The vendor delivers updates through rolling releases, and no specific fixed version has been published. Monitor the project repository on Gitee for commits addressing the sort parameter in ShangpinleixingController.java and apply them as soon as they are available.

Workarounds

Modify ShangpinleixingController.page to validate sort against a hardcoded allowlist of permitted column names before it reaches the query builder.
Use parameterized queries or an ORM abstraction that safely handles ordering fields when a fork or local patch is possible.
Run the application database account with the minimum privileges required, disabling FILE, EXECUTE, and multi-statement support where feasible.

bash

# Example WAF rule (ModSecurity) blocking SQLi patterns in the sort parameter
SecRule ARGS:sort "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|benchmark\s*\(|--|;|/\*)" \
    "id:1003318,phase:2,deny,status:403,msg:'CVE-2025-3318 SQLi attempt in sort parameter'"