CVE-2025-58462: FOIAXpress Public Access Link SQLi Flaw

CVE-2025-58462 Overview

A critical SQL injection vulnerability has been identified in OPEXUS FOIAXpress Public Access Link (PAL) before version 11.13.1.0. The vulnerability exists in the SearchPopularDocs.aspx page, which fails to properly sanitize user-supplied input before incorporating it into SQL queries. This allows a remote, unauthenticated attacker to execute arbitrary SQL commands against the underlying database, potentially leading to unauthorized data access, modification, or deletion of sensitive information.

FOIAXpress is a widely used Freedom of Information Act (FOIA) request management system deployed by government agencies and organizations to handle public records requests. The Public Access Link (PAL) component provides a public-facing portal for citizens to submit and track FOIA requests, making this vulnerability particularly concerning due to the sensitive nature of the data typically stored in these systems.

Critical Impact

Remote unauthenticated attackers can read, write, or delete any content in the database, potentially compromising sensitive government records and citizen data.

Affected Products

• OPEXUS FOIAXpress Public Access Link (PAL) versions prior to 11.13.1.0
• All deployments using the vulnerable SearchPopularDocs.aspx endpoint

Discovery Timeline

• 2025-09-09 - CVE-2025-58462 published to NVD
• 2025-09-26 - Last updated in NVD database

Technical Details for CVE-2025-58462

Vulnerability Analysis

This vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The SearchPopularDocs.aspx page in the FOIAXpress Public Access Link application accepts user input that is directly concatenated into SQL queries without proper parameterization or input validation. This classic SQL injection flaw enables attackers to manipulate the database query logic by injecting malicious SQL statements through the vulnerable parameter.

The attack surface is particularly dangerous because the vulnerable endpoint is accessible without authentication, meaning any remote attacker with network access to the PAL portal can exploit this vulnerability. Given that FOIAXpress systems typically store sensitive documents and personal information related to FOIA requests, successful exploitation could result in the exposure of confidential government records, citizen personal data, and internal agency communications.

Root Cause

The root cause of this vulnerability lies in the improper handling of user-supplied input within the SearchPopularDocs.aspx page. The application fails to implement parameterized queries or prepared statements, instead directly concatenating user input into SQL command strings. This lack of input sanitization and secure coding practices allows attackers to break out of the intended query context and inject arbitrary SQL commands.

Attack Vector

The vulnerability is exploitable over the network with no authentication required and no user interaction needed. An attacker can craft malicious HTTP requests to the SearchPopularDocs.aspx endpoint containing SQL injection payloads in the vulnerable parameters. These payloads can be designed to:

• Extract sensitive data from the database using UNION-based or blind SQL injection techniques
• Modify or delete existing records, potentially corrupting FOIA request data
• Bypass authentication mechanisms if user credentials are stored in the database
• Potentially achieve remote code execution depending on database server configuration and privileges

The vulnerability allows attackers to interact with the database with the same privileges as the application's database connection, which typically has read, write, and delete permissions on FOIA-related tables.

Detection Methods for CVE-2025-58462

Indicators of Compromise

• Anomalous requests to SearchPopularDocs.aspx containing SQL metacharacters such as single quotes, semicolons, or SQL keywords
• Unusual database query patterns or errors in application logs indicating malformed SQL statements
• Unexpected database modifications or data exfiltration attempts visible in database audit logs
• Increased traffic to the PAL portal from suspicious IP addresses or geographic regions

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns targeting the SearchPopularDocs.aspx endpoint
• Enable detailed logging on the web server and database to capture all requests to the vulnerable endpoint
• Deploy intrusion detection systems (IDS) with signatures for SQL injection attack patterns
• Monitor database query logs for unusual SELECT, INSERT, UPDATE, or DELETE operations originating from the PAL application

Monitoring Recommendations

• Configure alerting for any SQL syntax errors generated by the FOIAXpress application
• Establish baseline metrics for normal database activity and alert on significant deviations
• Implement real-time monitoring of web server access logs for requests containing SQL injection indicators
• Regularly review database audit logs for evidence of unauthorized data access or modification

How to Mitigate CVE-2025-58462

Immediate Actions Required

• Upgrade OPEXUS FOIAXpress Public Access Link to version 11.13.1.0 or later immediately
• If immediate patching is not possible, restrict network access to the SearchPopularDocs.aspx endpoint
• Deploy WAF rules to filter SQL injection attempts targeting the vulnerable endpoint
• Review database audit logs for evidence of prior exploitation attempts

Patch Information

OPEXUS has released version 11.13.1.0 of FOIAXpress Public Access Link which addresses this SQL injection vulnerability. Organizations should consult the Opexus Tech Release Notes for detailed upgrade instructions and additional security improvements included in this release. The GitHub CSAF Vulnerability Report provides additional technical details about the vulnerability.

Workarounds

• Implement a Web Application Firewall (WAF) with SQL injection protection rules in front of the PAL application as a compensating control
• Restrict access to the SearchPopularDocs.aspx page via network firewall rules or web server configuration until patching is complete
• Apply the principle of least privilege to the database account used by the FOIAXpress application to limit potential damage from exploitation
• Consider temporarily disabling the popular documents search functionality if the business impact is acceptable