CVE-2025-61167: SIGB PMB SQL Injection Vulnerability

CVE-2025-61167 Overview

CVE-2025-61167 is a SQL injection vulnerability in SIGB PMB version 8.0.1.14, an open-source integrated library management system. The flaw resides in the /opac_css/ajax_selector.php component and can be triggered through the id and datas parameters. Unauthenticated attackers can send crafted HTTP requests to inject arbitrary SQL statements into backend database queries. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated attackers can extract sensitive library and user data from the underlying database over the network without user interaction.

Affected Products

SIGB PMB version 8.0.1.14
Deployments exposing the /opac_css/ OPAC (Online Public Access Catalog) interface
Library systems using PMB before the 8.0.1 security patch series

Discovery Timeline

2025-11-25 - CVE-2025-61167 published to NVD
2026-07-05 - Last updated in NVD database

Technical Details for CVE-2025-61167

Vulnerability Analysis

SIGB PMB is a PHP-based library management application widely deployed by public libraries and educational institutions. The ajax_selector.php script inside the OPAC front-end handles asynchronous lookup requests used by selector widgets. Two request parameters, id and datas, are concatenated into SQL queries without adequate parameterization or type enforcement. An attacker can inject SQL syntax that alters the intended query, enabling data exfiltration through UNION-based or boolean-based injection techniques.

Because the endpoint sits within the public-facing OPAC, no authentication is required to reach the vulnerable code path. The impact is limited to confidentiality and integrity of database contents; availability is not directly affected according to the published scoring.

Root Cause

The root cause is missing input sanitization and lack of prepared statements in the ajax_selector.php handler. User-controlled values from id and datas reach the database layer as string concatenation rather than bound parameters. This is a textbook CWE-89 failure to neutralize special SQL characters before use in a query.

Attack Vector

An attacker sends an HTTP request to the OPAC endpoint with malicious payloads in the id or datas parameter. The request bypasses application logic and reaches the database, allowing the attacker to read arbitrary tables, including reader accounts, credentials, and administrative metadata. Exploitation code demonstrating the technique has been published as a public gist. See the GitHub Gist Exploit Code for technical details of the payload structure.

// No verified proof-of-concept code is reproduced here.
// Refer to the linked exploit gist for the full payload used against
// /opac_css/ajax_selector.php via the `id` and `datas` parameters.

Detection Methods for CVE-2025-61167

Indicators of Compromise

HTTP requests to /opac_css/ajax_selector.php containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( in the id or datas parameters.
Unusual database error responses or long response times originating from OPAC AJAX endpoints.
Web server access logs showing repeated ajax_selector.php requests from a single source with encoded payloads.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect id and datas parameters for SQL injection signatures on requests to ajax_selector.php.
Enable database query logging and alert on queries referencing PMB tables that contain injected syntax or unexpected UNION statements.
Correlate OPAC access logs with database audit logs to identify anomalous read patterns against reader or user tables.

Monitoring Recommendations

Monitor outbound data volumes from PMB database hosts for signs of bulk data exfiltration.
Track authentication anomalies on library staff accounts, since exfiltrated password hashes may enable follow-on access.
Alert on new administrative sessions originating from IP addresses previously seen probing OPAC endpoints.

How to Mitigate CVE-2025-61167

Immediate Actions Required

Upgrade SIGB PMB to a patched release documented in the SIGB Project Changelog.
Restrict network exposure of /opac_css/ajax_selector.php where the endpoint is not required for public catalog use.
Review web server and database logs since deployment for evidence of prior exploitation.

Patch Information

The SIGB project has published security fixes under the 8.0.1 branch. Administrators should review the vendor changelog and apply the referenced security patches addressing the ajax_selector.php injection points. Consult the SIGB Project Changelog for exact version details and upgrade instructions.

Workarounds

Block or rate-limit requests to /opac_css/ajax_selector.php at the reverse proxy or WAF layer until patching is complete.
Apply strict input validation upstream to reject non-numeric values for the id parameter and enforce an allow-list for datas.
Rotate database credentials and reset user passwords if log review indicates the endpoint may have been abused.

bash

# Example NGINX rule to block suspicious payloads against the vulnerable endpoint
location /opac_css/ajax_selector.php {
    if ($args ~* "(union|select|sleep\(|--|;|/\*)") {
        return 403;
    }
}