CVE-2025-8121: Widzialni Pad CMS SQLi Vulnerability

CVE-2025-8121 Overview

CVE-2025-8121 is a Blind SQL Injection vulnerability in Widzialni pad_cms, a Polish content management system. The flaw resides in the article positioning functionality, which fails to properly neutralize input supplied by an authenticated user. An attacker with low-privileged access can inject SQL statements that the backend database executes. The issue affects all three product templates: www, bip, and ww+bip. The vendor has declared the product End-Of-Life and will not release a patch. The vulnerability is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
An authenticated attacker can exfiltrate database contents, including credentials and content management records, with no available vendor patch.

Affected Products

Widzialni pad_cms — www template (all versions)
Widzialni pad_cms — bip template (all versions)
Widzialni pad_cms — ww+bip template (all versions)

Discovery Timeline

2025-09-30 - CVE-2025-8121 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8121

Vulnerability Analysis

The vulnerability is a Blind SQL Injection (CWE-89) in the article positioning feature of pad_cms. The application accepts ordering or positioning parameters from an authenticated session and concatenates them into a SQL query without parameterization or proper escaping. Because the endpoint does not return query results directly to the user, exploitation relies on boolean-based or time-based inference. Attackers observe differences in HTTP responses or response delays to extract data one bit at a time. The flaw applies uniformly across the www, bip, and Polish Public Information Bulletin combined (ww+bip) templates, indicating shared vulnerable code in the CMS core. Because the product is End-Of-Life, no upstream remediation will be issued, leaving operators to apply compensating controls or migrate.

Root Cause

The root cause is improper neutralization of user-controlled input passed to the article positioning handler. The handler embeds attacker-controlled values directly into a SQL statement, bypassing prepared statements or input allow-listing. Authorization checks confirm the user is logged in but do not validate the structure or content of positioning parameters.

Attack Vector

The attack vector is network-based over HTTP/HTTPS and requires low-privileged authenticated access to the CMS administrative interface. No user interaction is needed beyond the attacker's own session. The attacker submits crafted positioning requests against the vulnerable endpoint and infers data from response behavior. The CVSS 4.0 vector indicates high confidentiality and integrity impact on the vulnerable system, with low availability impact.

No public proof-of-concept exploit is currently available. Refer to the CERT.PL advisory for additional technical context on the disclosure.

Detection Methods for CVE-2025-8121

Indicators of Compromise

HTTP requests to article positioning endpoints containing SQL meta-characters such as ', --, OR 1=1, SLEEP(, BENCHMARK(, or UNION SELECT.
Repeated authenticated requests from a single session with incrementally varied parameter values, consistent with bit-by-bit blind extraction.
Anomalous response time distributions on positioning requests, indicating time-based blind SQL injection probing.
Database error entries referencing malformed queries originating from CMS positioning handlers.

Detection Strategies

Deploy a Web Application Firewall (WAF) ruleset tuned for SQL injection signatures on all pad_cms administrative endpoints.
Enable database query logging and alert on queries containing unexpected boolean tautologies, sleep functions, or INFORMATION_SCHEMA references from CMS service accounts.
Correlate authenticated session activity with abnormal request volume against positioning or ordering endpoints.

Monitoring Recommendations

Forward web server access logs and database audit logs to a centralized SIEM for correlation and retention.
Baseline normal positioning request volume per authenticated user and alert on deviations beyond two standard deviations.
Monitor for outbound data transfers from the CMS database server that exceed historical norms, which may indicate successful exfiltration.

How to Mitigate CVE-2025-8121

Immediate Actions Required

Restrict access to the pad_cms administrative interface to trusted IP ranges or a VPN, reducing the attack surface for authenticated exploitation.
Audit and revoke unnecessary CMS user accounts, and enforce strong, unique passwords with multi-factor authentication where supported.
Place the application behind a WAF configured to block SQL injection payloads against positioning parameters.
Plan migration to a supported CMS platform, since the vendor has confirmed End-Of-Life status with no forthcoming patches.

Patch Information

No patch will be released. The vendor has designated pad_cms as End-Of-Life across all affected templates (www, bip, ww+bip). Operators must rely on compensating controls or replace the product.

Workarounds

Apply WAF rules that block SQL meta-characters and known injection patterns in requests to article positioning endpoints.
Restrict the CMS database account to least privilege, removing rights to INFORMATION_SCHEMA, file operations, and cross-database queries.
Enable database-level query timeouts to limit the effectiveness of time-based blind injection techniques.
Isolate the CMS database server on a segmented network and disable outbound internet access from that host.

bash

# Example: restrict pad_cms admin access with nginx allow-list
location /admin/ {
    allow 10.0.0.0/8;          # internal admin network
    allow 192.0.2.10;          # specific admin workstation
    deny  all;
    proxy_pass http://padcms_backend;
}

# Example: revoke excessive privileges from the CMS database user
REVOKE FILE, PROCESS, SUPER ON *.* FROM 'padcms'@'localhost';
REVOKE SELECT ON information_schema.* FROM 'padcms'@'localhost';
FLUSH PRIVILEGES;