CVE-2025-7935: Fuyang_lipengjun Platform SQLi Vulnerability

CVE-2025-7935 Overview

CVE-2025-7935 is a SQL injection vulnerability in the fuyang_lipengjun platform, an open-source administrative application distributed via Gitee. The flaw resides in the SysLogController class located at platform-admin/src/main/java/com/platform/controller/SysLogController.java. Attackers can manipulate the key request parameter to inject arbitrary SQL statements into the underlying query. The product follows a rolling release model, so no discrete affected or fixed versions are published. The issue has been disclosed publicly, and exploitation requires only low-privileged authenticated access over the network.

Critical Impact
Authenticated remote attackers can inject SQL through the key parameter handled by SysLogController, exposing system log data and potentially other database content.

Affected Products

fuyang_lipengjun platform (rolling release up to commit ca9aceff6902feb7b0b6bf510842aea88430796a)
platform-admin module containing SysLogController.java
Deployments exposing the admin log search endpoint to network clients

Discovery Timeline

2025-07-21 - CVE-2025-7935 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-7935

Vulnerability Analysis

The vulnerability is a SQL injection issue classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command) and [CWE-74] (Improper Neutralization of Special Elements in Output). The defect lives in the SysLogController of the platform-admin module, which handles system log queries for administrative users. The controller accepts a key argument and forwards it into a database query without sufficient sanitization or parameterization. An attacker with a valid low-privilege session can craft input that breaks out of the intended query context. Successful exploitation can disclose log entries, user records, or other data accessible to the application database user. Because the product follows a continuous-delivery model, operators must inspect their deployed commit rather than rely on version numbers to determine exposure.

Root Cause

The root cause is direct concatenation or unsafe binding of the user-supplied key parameter into a SQL statement within SysLogController.java. The code path does not enforce parameterized queries or input validation before the value reaches the persistence layer. Frameworks such as MyBatis are commonly used in this codebase, where ${} placeholders perform string substitution rather than safe binding, which is a frequent source of this class of bug.

Attack Vector

The attack vector is network-based and requires low privileges with no user interaction. An attacker authenticates to the admin platform, then issues a crafted HTTP request to the system log endpoint with a malicious key value. The injected payload modifies the underlying query, enabling boolean-based, union-based, or time-based SQL injection techniques. No public proof-of-concept exploit code is referenced in the advisory, though the vulnerability details have been disclosed via VulDB and the project's Gitee issue tracker.

No verified exploit code is available. Refer to the Gitee Issue Report and VulDB entry #317064 for technical disclosure details.

Detection Methods for CVE-2025-7935

Indicators of Compromise

HTTP requests to system log endpoints in platform-admin containing SQL meta-characters such as ', --, UNION, SLEEP(, or OR 1=1 in the key parameter
Database error messages or stack traces returned to clients referencing SysLogController or log-query SQL statements
Unusual response latency on log-search endpoints suggesting time-based SQL injection probing
Database audit log entries showing queries against sys_log tables that include attacker-controlled clauses

Detection Strategies

Inspect web access logs for unencoded or URL-encoded SQL syntax in the key query string parameter targeting log management routes
Enable verbose query logging on the backing database and correlate anomalous statements with the application user used by platform-admin
Deploy a web application firewall rule that flags SQL injection signatures specifically on endpoints handled by SysLogController

Monitoring Recommendations

Alert on repeated 500-class responses from admin log endpoints, which often indicate injection probing
Monitor for spikes in query duration against sys_log and adjacent tables
Track authentication events for admin accounts that subsequently issue high volumes of log-search requests

How to Mitigate CVE-2025-7935

Immediate Actions Required

Restrict network access to the platform-admin console using an allowlist or VPN until a code fix is applied
Audit and rotate credentials for any low-privileged admin accounts that could be abused to reach SysLogController
Reduce the database account's privileges so the application cannot read or modify tables outside its required scope

Patch Information

The vendor distributes the platform as a rolling release with no formal version numbers. No specific patch commit is identified in the published advisory. Operators should monitor the Gitee Issue Report for upstream fixes and rebuild from the latest commit that addresses the key parameter handling in SysLogController.java. Until then, apply application-level mitigations.

Workarounds

Apply a local patch that replaces string concatenation in SysLogController with parameterized queries or MyBatis #{} bindings
Add server-side validation that rejects non-alphanumeric characters in the key parameter before it reaches the persistence layer
Deploy a WAF rule blocking SQL injection patterns on admin log routes
Disable or remove the affected log-search endpoint if it is not operationally required

bash

# Example WAF rule (ModSecurity) blocking SQLi patterns on the log endpoint
SecRule REQUEST_URI "@contains /sys/log" \
    "chain,phase:2,deny,status:403,id:1007935,\
     msg:'CVE-2025-7935 SQLi attempt against SysLogController'"
    SecRule ARGS:key "@rx (?i)(union(\s|/\*).*select|sleep\s*\(|or\s+1=1|--|;)" \
        "t:none,t:urlDecodeUni"