CVE-2025-6095: Jasmin-ransomware SQL Injection Flaw

CVE-2025-6095 Overview

A critical SQL injection vulnerability was discovered in codesiddhant Jasmin Ransomware version 1.0.1. The vulnerability exists in the /checklogin.php file, where improper handling of the username and password parameters allows attackers to inject malicious SQL commands. This flaw enables remote attackers to bypass authentication, extract sensitive data, or manipulate database contents without requiring any prior authentication or user interaction.

Critical Impact

Remote attackers can exploit this SQL injection vulnerability to bypass authentication mechanisms, access sensitive ransomware control panel data, or potentially gain complete control over the underlying database system.

Affected Products

• codesiddhant Jasmin Ransomware version 1.0.1

Discovery Timeline

• 2025-06-15 - CVE-2025-6095 published to NVD
• 2025-11-14 - Last updated in NVD database

Technical Details for CVE-2025-6095

Vulnerability Analysis

This SQL injection vulnerability affects the authentication mechanism of the Jasmin Ransomware control panel. The /checklogin.php endpoint fails to properly sanitize user-supplied input in both the username and password parameters before incorporating them into SQL queries. This allows an attacker to craft malicious input that alters the intended SQL query logic, potentially enabling authentication bypass, data exfiltration, or database manipulation.

The vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), which encompasses injection flaws where user input is not properly sanitized before being processed. The exploit has been publicly disclosed and proof-of-concept documentation is available, increasing the risk of active exploitation.

The vendor (codesiddhant) was contacted regarding this disclosure but did not respond, leaving users without an official patch or mitigation guidance.

Root Cause

The root cause of this vulnerability is the failure to implement proper input validation and parameterized queries in the /checklogin.php authentication handler. User-supplied values for the username and password fields are directly concatenated into SQL query strings without sanitization or the use of prepared statements. This classic SQL injection pattern allows attackers to inject SQL syntax that modifies query behavior.

Attack Vector

The attack can be executed remotely over the network without requiring authentication or user interaction. An attacker submits specially crafted input containing SQL metacharacters and commands through the login form's username or password fields. The malicious payload is then executed by the database engine, allowing the attacker to:

• Bypass authentication by injecting conditions that always evaluate to true
• Extract sensitive data from the database using UNION-based or error-based injection techniques
• Modify or delete database records
• Potentially escalate to operating system command execution depending on database configuration

Technical details and proof-of-concept information are documented in the GitHub SQLi Username Exploit and GitHub SQLi Password Exploit repositories.

Detection Methods for CVE-2025-6095

Indicators of Compromise

• HTTP POST requests to /checklogin.php containing SQL injection payloads such as ' OR '1'='1, UNION SELECT, or comment sequences (--, #)
• Unusual database query patterns including error messages or timing anomalies from the authentication endpoint
• Successful logins from unexpected IP addresses or without valid credentials being present in authentication logs
• Database logs showing injection attempts or unauthorized data access queries

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block common SQL injection patterns targeting the /checklogin.php endpoint
• Implement application-layer logging to capture all authentication attempts with full request parameters for forensic analysis
• Monitor database query logs for anomalous query structures, syntax errors, or UNION-based injection signatures
• Configure intrusion detection systems (IDS) with signatures for SQL injection attack patterns

Monitoring Recommendations

• Enable verbose logging on web servers handling requests to /checklogin.php and correlate with database logs
• Set up alerts for multiple failed authentication attempts followed by successful logins from the same source
• Monitor for unusual database activity such as bulk data extraction or schema enumeration queries
• Implement real-time alerting for WAF blocks or IDS detections related to SQL injection attempts

How to Mitigate CVE-2025-6095

Immediate Actions Required

• Remove or restrict network access to the Jasmin Ransomware control panel immediately if not required for operations
• Implement network-level access controls (firewall rules, IP whitelisting) to limit who can reach the /checklogin.php endpoint
• Deploy a Web Application Firewall with SQL injection protection rules in front of the affected application
• Audit database logs and access records for signs of prior exploitation

Patch Information

No official patch is currently available from the vendor. The vendor (codesiddhant) was contacted about this vulnerability but did not respond. Users should consider the software unsupported and implement alternative mitigations or discontinue use of the affected product.

For additional technical information, refer to:

• VulDB Entry #312564
• VulDB Submission #588833

Workarounds

• Restrict access to /checklogin.php via web server configuration (e.g., .htaccess rules or nginx location blocks) to trusted IP addresses only
• If source code access is available, implement parameterized queries (prepared statements) for all database interactions in the authentication logic
• Place the application behind a reverse proxy with SQL injection filtering capabilities
• Consider migrating to alternative software that is actively maintained and follows secure coding practices

# Example: Apache .htaccess to restrict access to checklogin.php
<Files "checklogin.php">
    Order Deny,Allow
    Deny from all
    Allow from 10.0.0.0/8
    Allow from 192.168.1.0/24
</Files>