CVE-2025-5107: Kirisun Fujian Kelixun SQL Injection Flaw

CVE-2025-5107 Overview

A critical SQL injection vulnerability has been identified in Fujian Kelixun version 1.0. The vulnerability exists in the file /app/xml_cdr/xml_cdr_details.php where improper handling of the uuid parameter allows attackers to inject malicious SQL statements. This flaw enables remote attackers with low privileges to manipulate database queries, potentially leading to unauthorized data access, modification, or deletion.

The vulnerability has been publicly disclosed and exploit information is available, increasing the risk of active exploitation. Notably, the vendor was contacted about this security issue but did not respond, leaving users without an official patch.

Critical Impact

Remote attackers can exploit this SQL injection vulnerability to extract sensitive data, modify database contents, or potentially gain unauthorized access to the underlying system through database manipulation.

Affected Products

• Kirisun Fujian Kelixun 1.0

Discovery Timeline

• 2025-05-23 - CVE CVE-2025-5107 published to NVD
• 2025-10-14 - Last updated in NVD database

Technical Details for CVE-2025-5107

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) occurs due to insufficient input validation in the XML CDR details functionality of the Fujian Kelixun application. The uuid parameter in /app/xml_cdr/xml_cdr_details.php is directly concatenated into SQL queries without proper sanitization or parameterization.

The vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and CWE-89 (SQL Injection), indicating that user-supplied input is not properly neutralized before being incorporated into SQL commands.

The attack can be initiated remotely over the network and requires only low-level privileges to execute, making it accessible to a wide range of potential attackers. Successful exploitation could compromise the confidentiality, integrity, and availability of data stored in the application's database.

Root Cause

The root cause of this vulnerability is improper input validation and the lack of parameterized queries in the PHP code handling the uuid parameter. When user input is directly embedded into SQL statements without proper escaping or using prepared statements, it creates an injection point that attackers can exploit.

The affected endpoint /app/xml_cdr/xml_cdr_details.php appears to handle call detail record (CDR) information, and the uuid parameter is likely used to retrieve specific record details. Without proper sanitization, specially crafted input can break out of the intended query structure and execute arbitrary SQL commands.

Attack Vector

The attack vector is network-based, allowing remote exploitation without requiring physical access to the target system. An authenticated attacker with low privileges can manipulate the uuid parameter by injecting SQL syntax to alter the query's behavior.

Typical exploitation techniques include:

• UNION-based injection: Appending UNION SELECT statements to extract data from other database tables
• Boolean-based blind injection: Using conditional statements to infer data based on application responses
• Time-based blind injection: Leveraging database time delay functions to extract information character by character
• Error-based injection: Triggering database errors that reveal information about the database structure

For technical details and proof-of-concept information, refer to the GitHub Issue on CVE and the VulDB CTI Report #310084.

Detection Methods for CVE-2025-5107

Indicators of Compromise

• Unusual SQL error messages in application logs from /app/xml_cdr/xml_cdr_details.php
• HTTP requests to xml_cdr_details.php containing SQL syntax characters in the uuid parameter (single quotes, double dashes, UNION keywords, etc.)
• Abnormal database query patterns or unexpected data access from the CDR tables
• Authentication anomalies or privilege escalation events following CDR detail page access

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in requests to the affected endpoint
• Enable detailed logging for the /app/xml_cdr/ directory and monitor for suspicious parameter values
• Deploy database activity monitoring to detect anomalous queries originating from the web application
• Configure intrusion detection systems (IDS) with signatures for common SQL injection payloads

Monitoring Recommendations

• Review web server access logs for requests to xml_cdr_details.php with encoded or suspicious uuid values
• Set up alerts for database errors related to malformed SQL queries
• Monitor for unusual data exfiltration patterns or bulk data access from CDR-related tables
• Implement application performance monitoring to detect anomalous response times that may indicate time-based SQL injection attempts

How to Mitigate CVE-2025-5107

Immediate Actions Required

• Restrict network access to the affected endpoint /app/xml_cdr/xml_cdr_details.php using firewall rules or access control lists
• Implement a Web Application Firewall with SQL injection protection rules in front of the application
• Review and limit database user privileges used by the application to minimize potential impact
• Consider temporarily disabling the affected functionality if it is not critical to operations

Patch Information

No official patch has been released by Kirisun for this vulnerability. The vendor was contacted regarding this disclosure but did not respond. Users should monitor the vendor's official channels for any future security updates and implement the recommended workarounds in the meantime.

For additional technical details and community updates, refer to VulDB #310084.

Workarounds

• Implement input validation and parameterized queries at the application level if source code access is available
• Deploy a reverse proxy with SQL injection filtering capabilities to inspect and sanitize incoming requests
• Use network segmentation to isolate the vulnerable application from critical systems and sensitive data
• Apply principle of least privilege to database accounts, ensuring the application user has minimal necessary permissions
• Consider virtual patching through WAF rules specifically targeting the uuid parameter in the affected endpoint

# Example: Apache mod_security rule to block SQL injection in uuid parameter
SecRule ARGS:uuid "@detectSQLi" \
    "id:1001,\
    phase:2,\
    deny,\
    status:403,\
    msg:'SQL Injection attempt detected in uuid parameter',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}'"