CVE-2025-6096: Jasmin Ransomware SQL Injection Flaw

CVE-2025-6096 Overview

CVE-2025-6096 is a SQL injection vulnerability in codesiddhant Jasmin Ransomware through version 1.0.1. The flaw resides in the /dashboard.php component, where the Search parameter is not properly sanitized before being incorporated into a database query. A remote attacker with low-privileged access can manipulate the Search argument to inject arbitrary SQL statements. The vulnerability is categorized under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). Public exploit details have been disclosed, and the vendor did not respond to disclosure attempts.

Critical Impact
Authenticated remote attackers can inject SQL into the dashboard search functionality, potentially exposing or modifying backend database contents.

Affected Products

codesiddhant Jasmin Ransomware 1.0.1
codesiddhant Jasmin Ransomware prior versions up to 1.0.1
Deployments exposing /dashboard.php to remote users

Discovery Timeline

2025-06-16 - CVE-2025-6096 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6096

Vulnerability Analysis

The vulnerability exists in the dashboard.php script of the Jasmin Ransomware project, an open-source ransomware simulation tool published on GitHub. The script accepts a Search HTTP parameter and concatenates the value directly into a SQL statement without parameterization or input validation. An attacker submits crafted SQL syntax through the Search field, and the database engine executes the injected payload as part of the original query.

Exploitation requires network reachability to the application and low-privileged user context (PR:L). No user interaction is necessary, and the attack complexity is low. Successful exploitation impacts confidentiality, integrity, and availability of the backend database at a limited level, allowing extraction of stored records, manipulation of dashboard data, or query-based denial of service.

Root Cause

The root cause is improper neutralization of special characters supplied through the Search query string parameter. The application constructs SQL queries through string concatenation rather than using prepared statements or parameterized queries. Standard SQL meta-characters such as single quotes, UNION, and comment sequences pass unchanged into the query parser.

Attack Vector

The attack vector is remote over HTTP. An authenticated low-privileged user issues a GET or POST request to /dashboard.php containing a malicious value in the Search parameter. Technical analysis of the injection point is documented in the GitHub Ransomware Analysis writeup. Additional registry entries are available at VulDB #312565.

// No verified exploit code published in NVD references.
// Refer to the linked GitHub analysis for the proof-of-concept payload.

Detection Methods for CVE-2025-6096

Indicators of Compromise

HTTP requests to /dashboard.php containing SQL meta-characters such as ', --, UNION SELECT, or OR 1=1 in the Search parameter
Web server logs showing repeated Search parameter values with encoded payloads (%27, %20OR%20)
Database error messages returned to the client referencing syntax errors in dynamically built queries
Unexpected database read volume tied to the dashboard application user account

Detection Strategies

Deploy web application firewall signatures that flag SQL injection patterns targeting the Search parameter on /dashboard.php
Enable database query auditing to record statements originating from the Jasmin Ransomware application database user
Correlate authenticated session activity with anomalous query structures using SIEM rules

Monitoring Recommendations

Monitor outbound data volume from the database host for spikes consistent with UNION-based extraction
Track failed and successful authentications to the dashboard alongside Search parameter content
Alert on database errors logged to the web application logs to identify probing activity

How to Mitigate CVE-2025-6096

Immediate Actions Required

Remove or isolate any Jasmin Ransomware deployments from production and internet-reachable networks
Restrict access to /dashboard.php behind network-level controls until a patched fork is available
Rotate database credentials used by the application and review the database for unauthorized modifications
Audit hosting environments for the presence of this project, as it is a ransomware simulation tool not intended for production use

Patch Information

No official vendor patch is available. The vendor was contacted prior to disclosure and did not respond. Organizations using the codebase should apply source-level fixes by replacing the vulnerable concatenated query in dashboard.php with a parameterized statement using PDO prepared statements or mysqli_prepare() bindings, and by validating that the Search parameter conforms to an expected character set.

Workarounds

Apply WAF rules to block SQL meta-characters in the Search query parameter for requests targeting /dashboard.php
Enforce strict input validation in a reverse proxy by rejecting requests where Search contains characters outside an alphanumeric allow-list
Restrict the database account used by the application to read-only permissions on a minimal set of tables
Decommission the application entirely if it is not required, as the project is a ransomware simulator and presents broader operational risk

bash

# Example ModSecurity rule blocking SQLi patterns on the Search parameter
SecRule ARGS:Search "@detectSQLi" \
  "id:1006096,phase:2,deny,status:403,\
  msg:'CVE-2025-6096 Jasmin Ransomware dashboard.php SQLi attempt'"