CVE-2025-7156: Airda Chat Completions SQL Injection Flaw

CVE-2025-7156 is a critical SQL injection vulnerability in hitsz-ids airda 0.0.3 affecting the chat completions endpoint. Attackers can exploit the question parameter remotely to execute unauthorized SQL queries. This post covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2025-7156 Overview

CVE-2025-7156 is a SQL injection vulnerability in hitsz-ids airda version 0.0.3. The flaw resides in the execute function of the /v1/chat/completions endpoint. Attackers can manipulate the question argument to inject arbitrary SQL statements. The vulnerability can be triggered remotely by any authenticated user with low privileges. Public disclosure of the exploit details has occurred through VulDB, increasing the likelihood of opportunistic exploitation attempts against exposed instances. The issue is categorized under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Remote attackers with low privileges can inject SQL statements through the question parameter of the chat completions endpoint, potentially exposing or modifying backend database contents.

Affected Products

hitsz-ids airda 0.0.3
Component: /v1/chat/completions endpoint
Function: execute

Discovery Timeline

2025-07-08 - CVE-2025-7156 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7156

Vulnerability Analysis

The vulnerability affects the execute function invoked by the /v1/chat/completions API endpoint in airda 0.0.3. User-controlled input supplied through the question parameter flows into a database query without proper sanitization or parameterization. An attacker submitting a crafted chat completion request can break out of the intended query context and execute arbitrary SQL statements against the backend data store.

Since airda is an AI-oriented data analysis assistant, the question field is designed to accept natural language input that is translated into database operations. This design pattern expands the attack surface because free-form user text is directly consumed by query-building logic. Public exploit details are available through the VulDB Entry #315094 and a CNBlogs technical write-up.

Root Cause

The root cause is improper neutralization of special elements passed to a downstream SQL interpreter [CWE-74]. The execute function constructs or forwards queries that incorporate the question argument without using parameterized statements or input validation. Any SQL metacharacters supplied by the caller are interpreted as syntax rather than data.

Attack Vector

Exploitation requires network access to the airda API and a low-privileged account to reach the /v1/chat/completions route. An attacker sends a POST request containing a question payload with embedded SQL syntax. The injected statement executes with the privileges of the database user that airda uses, enabling data extraction, modification, or enumeration of database schema depending on backend permissions.

No verified proof-of-concept code is reproduced here. Technical details are documented in the referenced VulDB and CNBlogs sources.

Detection Methods for CVE-2025-7156

Indicators of Compromise

POST requests to /v1/chat/completions containing SQL metacharacters such as single quotes, UNION SELECT, --, or ; in the question field.
Unexpected database errors or stack traces returned from the airda application correlated with chat completion requests.
Anomalous outbound database queries originating from the airda service account outside normal application patterns.

Detection Strategies

Deploy a web application firewall rule inspecting the JSON body of /v1/chat/completions requests for common SQL injection signatures.
Enable verbose logging on the airda application and the backing database to correlate request payloads with executed SQL statements.
Monitor authentication logs for low-privileged accounts generating unusual volumes of chat completion requests.

Monitoring Recommendations

Alert on database errors returned to API clients, which often indicate injection probing.
Baseline normal query patterns from the airda service account and alert on deviations such as schema enumeration queries against information_schema.
Capture full request bodies for the /v1/chat/completions endpoint for forensic review.

How to Mitigate CVE-2025-7156

Immediate Actions Required

Restrict network exposure of airda 0.0.3 instances to trusted internal networks only until a patched release is available.
Audit accounts with access to the airda API and remove unnecessary low-privileged accounts that could reach the vulnerable endpoint.
Review database logs for prior exploitation attempts referencing the question parameter.

Patch Information

No vendor patch has been published in the referenced CVE data. Monitor the upstream hitsz-ids/airda repository for a fixed release and track the VulDB CTI Report #315094 for update information.

Workarounds

Place airda behind a reverse proxy or API gateway that filters SQL metacharacters in the question field of /v1/chat/completions requests.
Reduce the privileges of the database account used by airda to the minimum required for read-only operations where feasible.
Disable or firewall the /v1/chat/completions endpoint for untrusted users until the component is upgraded.

bash

# Example nginx location block restricting access to trusted CIDR
location /v1/chat/completions {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://airda_backend;
}