CVE-2025-44034: Aaluoxiang OA System SQLi Vulnerability

CVE-2025-44034 Overview

CVE-2025-44034 is a SQL injection vulnerability [CWE-89] in the aaluoxiang oa_system (oasys) office automation application, version 1.1. The flaw resides in the AddrController class located at src/main/java/cn/gson/oasys/controller/address/AddrController, where the alph parameter is passed to a database query without proper sanitization. A remote authenticated attacker on an adjacent network can inject arbitrary SQL statements through this parameter. Successful exploitation can lead to unauthorized data access, data modification, and, according to the vendor description, arbitrary code execution via the database layer.

Critical Impact
An authenticated attacker on the adjacent network can inject SQL through the alph parameter to read, modify, or destroy database contents and potentially execute arbitrary code.

Affected Products

aaluoxiang oa_system (oasys) version 1.1
Component: src/main/java/cn/gson/oasys/controller/address/AddrController
CPE: cpe:2.3:a:aaluoxiang:oa_system:1.1:*:*:*:*:*:*:*

Discovery Timeline

2025-09-16 - CVE-2025-44034 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-44034

Vulnerability Analysis

The oa_system application is a Java-based office automation platform. The AddrController handles address book functionality and accepts an alph request parameter used to filter contact entries by alphabetical prefix. The controller concatenates this parameter into a SQL statement rather than binding it as a parameterized query value. An attacker can therefore break out of the intended query context and append arbitrary SQL clauses.

Because the underlying database driver and stack support stacked queries and, in certain configurations, out-of-band execution primitives, the vendor description notes that exploitation can extend beyond data disclosure to arbitrary code execution. The attacker must be authenticated at a low-privilege level and must reach the application over an adjacent network segment.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. User-controlled input from the alph HTTP parameter flows into a dynamically constructed SQL query inside AddrController without prepared statements or input validation. Any character permitted in an HTTP query string is passed directly to the database engine.

Attack Vector

An authenticated user issues an HTTP request to the address-book endpoint served by AddrController and supplies a malicious payload in the alph parameter. The payload closes the original expression and appends attacker-controlled SQL, such as UNION SELECT statements to exfiltrate credentials or stacked statements to modify records. Technical details and proof-of-concept material are referenced in the GitHub SQL Injection Resource.

Detection Methods for CVE-2025-44034

Indicators of Compromise

HTTP requests to address-book endpoints containing SQL keywords such as UNION, SELECT, SLEEP, --, or /* inside the alph query parameter.
Unusual database query patterns originating from the oa_system application user, including queries against system tables like information_schema.
Web application log entries showing abnormally long or URL-encoded alph values from authenticated sessions.

Detection Strategies

Deploy web application firewall (WAF) signatures that inspect the alph parameter for SQL metacharacters and known injection payloads.
Enable database query logging and alert on queries containing tautologies (OR 1=1), stacked statements, or time-delay functions issued by the application account.
Correlate authentication events with subsequent anomalous address-book requests to identify low-privileged accounts probing the endpoint.

Monitoring Recommendations

Baseline normal AddrController request patterns and alert on statistical deviations in parameter length or entropy.
Monitor outbound connections from the database host, since SQL injection can be leveraged for out-of-band data exfiltration.
Ingest application and database logs into a centralized analytics platform to enable cross-source correlation of injection attempts.

How to Mitigate CVE-2025-44034

Immediate Actions Required

Restrict network access to the oa_system application so it is not reachable from untrusted adjacent network segments.
Audit application accounts and disable or rotate credentials for low-privileged users who do not require access to the address book module.
Enable database account least-privilege controls so the application user cannot execute administrative statements or write to the filesystem.

Patch Information

No vendor patch or advisory URL is listed in the NVD entry for CVE-2025-44034. Because oa_system version 1.1 is the only affected release identified and no fixed version has been published by the maintainer, operators should treat the deployment as unpatched. Consult the GitHub SQL Injection Resource for the current technical description and monitor the upstream repository for updates.

Workarounds

Place the application behind a WAF configured to block SQL metacharacters in the alph parameter until a code-level fix is available.
If source access is available, modify AddrController to use parameterized queries or prepared statements when handling the alph value.
Apply strict input validation that limits alph to a single alphabetic character, matching its intended semantic use.
Disable or remove the address book module if it is not required by business workflows.

bash

# Example WAF rule (ModSecurity syntax) to block SQL metacharacters in the alph parameter
SecRule ARGS:alph "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|--|;|/\*|\bor\b\s+\d+=\d+)" \
    "id:1004403,phase:2,deny,status:403,log,msg:'CVE-2025-44034 oa_system SQLi attempt in alph parameter'"