CVE-2025-60266: Bestfeng Xckk SQL Injection Vulnerability

CVE-2025-60266 Overview

CVE-2025-60266 is a SQL injection vulnerability in Bestfeng xckk version 9.6. The flaw exists in the address/list endpoint, where the orderBy parameter is not properly filtered before being incorporated into a SQL query. Remote attackers can inject arbitrary SQL syntax through this parameter without authentication or user interaction. The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated attackers can manipulate database queries through the orderBy parameter, potentially exposing or modifying stored application data.

Affected Products

Bestfeng xckk 9.6
CPE: cpe:2.3:a:bestfeng:xckk:9.6:*:*:*:*:*:*:*
Component: bestfeng:xckk

Discovery Timeline

2025-10-09 - CVE-2025-60266 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60266

Vulnerability Analysis

The vulnerability resides in the address/list endpoint of xckk v9.6. The application accepts an orderBy request parameter and appends it directly to a SQL query used for sorting result sets. Because ORDER BY clauses cannot be safely parameterized in most database drivers, developers must apply an allow-list against expected column names. The affected code performs no such validation, allowing attacker-controlled SQL fragments to modify query semantics.

An attacker sending a crafted HTTP request to address/list with a malicious orderBy value can extract data from the underlying database through techniques such as UNION-based extraction, boolean-based blind injection, or time-based blind injection. The confidentiality and integrity of application data are both affected.

Root Cause

The root cause is missing input sanitization and the absence of an allow-list for sortable columns in the orderBy handler. User-supplied text passes directly into the SQL statement string, giving attackers control over the query structure after the ORDER BY keyword.

Attack Vector

Exploitation is performed over the network against the vulnerable HTTP endpoint. No authentication or user interaction is required. The attacker submits a request to address/list with a manipulated orderBy query parameter containing SQL syntax such as subqueries, CASE expressions, or stacked identifiers designed to leak data through observable query behavior.

See the GitHub Issue Report #2 and the Gitee Repository for XCKK for the disclosure and source references.

Detection Methods for CVE-2025-60266

Indicators of Compromise

HTTP requests to address/list containing SQL keywords such as SELECT, UNION, SLEEP, BENCHMARK, or CASE WHEN inside the orderBy parameter.
Repeated timing-anomaly requests to the same endpoint, consistent with time-based blind SQL injection probing.
Database error messages or unusually long response times originating from queries against the address list table.

Detection Strategies

Deploy web application firewall (WAF) signatures that inspect the orderBy parameter for SQL metacharacters and reserved keywords.
Enable database query logging and alert on ORDER BY clauses that contain subqueries, function calls, or comment sequences (--, /*).
Correlate HTTP access logs with database slow-query logs to identify patterns indicative of blind injection.

Monitoring Recommendations

Monitor request rates and payload entropy for the address/list endpoint from single source IPs.
Track outbound data volumes from the application database to detect bulk extraction attempts.
Review authentication and application audit logs for anomalous access patterns tied to the affected component.

How to Mitigate CVE-2025-60266

Immediate Actions Required

Restrict network access to the address/list endpoint to trusted networks until a fix is applied.
Deploy WAF rules that reject orderBy values not matching an allow-list of known column names.
Audit application and database logs for prior exploitation attempts against the affected endpoint.

Patch Information

No vendor advisory or official patch has been published in the referenced sources at the time of writing. Track the Gitee Repository for XCKK for upstream updates and apply new releases addressing the orderBy handling as soon as they are available.

Workarounds

Implement a server-side allow-list mapping accepted orderBy values to fixed column identifiers before query construction.
Refactor the SQL builder to use parameterized queries and strict type validation for all user-controlled inputs.
Enforce least-privilege database accounts so the application user cannot read tables outside its functional scope.

bash

# Example WAF rule concept blocking SQL metacharacters in orderBy
# (ModSecurity-style pseudo-rule)
SecRule ARGS:orderBy "@rx (?i)(select|union|sleep|benchmark|--|/\*|;)" \
  "id:1060266,phase:2,deny,status:403,msg:'CVE-2025-60266 orderBy SQLi attempt'"