CVE-2025-6116: Das Parking Management System SQLi Flaw

CVE-2025-6116 Overview

A critical SQL injection vulnerability has been identified in Das Parking Management System (停车场管理系统) version 6.2.0. This vulnerability affects the /IntraFieldVehicle/Search API endpoint, where improper handling of the Value argument allows attackers to inject malicious SQL commands. The vulnerability can be exploited remotely without authentication, potentially leading to unauthorized database access, data manipulation, and system compromise.

Critical Impact

Remote attackers can exploit this SQL injection flaw to extract sensitive parking management data, modify database records, or potentially escalate to full database server compromise.

Affected Products

• Das Parking Management System version 6.2.0
• das parking_management_system (cpe:2.3:a:das:parking_management_system:6.2.0:::::::*)

Discovery Timeline

• June 16, 2025 - CVE-2025-6116 published to NVD
• October 9, 2025 - Last updated in NVD database

Technical Details for CVE-2025-6116

Vulnerability Analysis

This SQL injection vulnerability exists in the Das Parking Management System's vehicle search functionality. The /IntraFieldVehicle/Search API endpoint fails to properly sanitize the Value parameter before incorporating it into SQL queries. This allows attackers to inject arbitrary SQL statements that are executed in the context of the database connection used by the application.

The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The exploit has been publicly disclosed, increasing the risk of active exploitation against unpatched systems.

Root Cause

The root cause of this vulnerability is insufficient input validation and lack of parameterized queries in the vehicle search API. The Value argument is directly concatenated into SQL queries without proper sanitization or the use of prepared statements. This classic SQL injection pattern allows user-supplied input to modify the structure and behavior of database queries.

Attack Vector

The vulnerability can be exploited remotely over the network without requiring authentication. An attacker can craft malicious HTTP requests to the /IntraFieldVehicle/Search endpoint with specially crafted SQL payloads in the Value parameter. Since no user interaction is required, this attack can be automated and executed at scale against vulnerable installations.

The attack flow involves sending a request to the affected API endpoint with SQL metacharacters and commands embedded in the Value parameter. Depending on the database backend and permissions, attackers may be able to extract data, modify records, or execute operating system commands through database-specific features like xp_cmdshell (SQL Server) or LOAD_FILE (MySQL).

For technical details and proof-of-concept information, refer to the GitHub MXdocument Resource and VulDB #312585.

Detection Methods for CVE-2025-6116

Indicators of Compromise

• Unusual or malformed requests to /IntraFieldVehicle/Search containing SQL syntax such as UNION, SELECT, OR 1=1, single quotes, or comment sequences (--, /**/)
• Database error messages in application logs indicating SQL syntax errors or unexpected query behavior
• Abnormal database query patterns or increased query execution times
• Evidence of data exfiltration or unauthorized database access in audit logs

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns targeting the /IntraFieldVehicle/Search endpoint
• Implement application-level logging to capture all requests to the vulnerable API endpoint with full parameter values
• Configure database activity monitoring to alert on suspicious query patterns, including UNION-based attacks and time-based blind SQL injection attempts
• Use intrusion detection systems (IDS) with SQL injection signatures to monitor network traffic to parking management system servers

Monitoring Recommendations

• Enable detailed access logging for the Das Parking Management System and forward logs to a SIEM solution
• Monitor for high-frequency requests to the /IntraFieldVehicle/Search endpoint that may indicate automated exploitation attempts
• Set up alerts for database errors and exceptions that may indicate attempted SQL injection attacks
• Review database user permissions and audit privileged operations on the parking management database

How to Mitigate CVE-2025-6116

Immediate Actions Required

• Restrict network access to the Das Parking Management System to trusted IP addresses only using firewall rules
• Place a Web Application Firewall (WAF) in front of the application to filter malicious SQL injection payloads
• Disable or restrict access to the /IntraFieldVehicle/Search API endpoint if not business-critical
• Monitor for exploitation attempts and investigate any suspicious activity targeting the affected endpoint
• Review and audit database access permissions to minimize potential impact if exploitation occurs

Patch Information

At the time of this publication, no official patch information is available from the vendor. Organizations should monitor vendor communications and the VulDB entry for updates regarding security patches. Consider contacting the vendor directly to inquire about patch availability and expected timeline.

Workarounds

• Implement input validation at the application or WAF level to reject requests containing SQL metacharacters in the Value parameter
• Deploy network segmentation to isolate the parking management system from critical infrastructure
• Use database connection accounts with minimal privileges to limit the impact of successful SQL injection attacks
• Consider deploying a reverse proxy with request filtering capabilities to sanitize input before it reaches the application

# Example WAF rule for blocking common SQL injection patterns (ModSecurity format)
SecRule ARGS:Value "@detectSQLi" \
    "id:1001,\
    phase:2,\
    deny,\
    status:403,\
    msg:'SQL Injection attempt detected in Value parameter',\
    log,\
    auditlog"