CVE-2025-8702: Wanzhou WOES Energy System SQLi Flaw

CVE-2025-8702 Overview

CVE-2025-8702 is a SQL injection vulnerability affecting Wanzhou WOES Intelligent Optimization Energy Saving System version 1.0. The flaw resides in the /CommonSolution/GetVariableByOneIDNew endpoint within the Historical Data Query Module. Attackers can manipulate the ObjectID parameter to inject arbitrary SQL statements against the backend database. The vulnerability is exploitable remotely over the network and requires low privileges. The exploit details have been publicly disclosed, increasing the risk of opportunistic abuse against exposed installations.

Critical Impact
Remote authenticated attackers can inject SQL queries through the ObjectID parameter, potentially exposing or modifying historical energy-management data stored in the backend database.

Affected Products

Wanzhou WOES Intelligent Optimization Energy Saving System 1.0
Component: Historical Data Query Module
Endpoint: /CommonSolution/GetVariableByOneIDNew

Discovery Timeline

2025-08-08 - CVE-2025-8702 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8702

Vulnerability Analysis

The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and manifests as SQL injection. The /CommonSolution/GetVariableByOneIDNew handler accepts an ObjectID parameter and incorporates the value into a SQL query without proper sanitization or parameterization. An authenticated attacker can supply crafted SQL syntax through this parameter to alter the structure of the executed query.

Because WOES is an energy-management platform, the affected database typically stores operational telemetry, device identifiers, and historical metering data. Successful injection can disclose this data or allow modification of stored records. The attack requires no user interaction and can be performed over the network against any reachable instance.

Root Cause

The root cause is a lack of input validation and the use of dynamic SQL concatenation when processing the ObjectID parameter. The application trusts client-supplied input and passes it directly into a query string sent to the database driver. Parameterized queries or prepared statements would have prevented the injection.

Attack Vector

The attack vector is network-based. An attacker with low-level credentials submits an HTTP request to /CommonSolution/GetVariableByOneIDNew with a malicious ObjectID value containing SQL meta-characters or stacked queries. The injected payload is executed by the backend database in the context of the application's database user. See the GitHub Issue Discussion and the VulDB entry #319131 for additional technical context.

No verified proof-of-concept code is available for republication. Refer to the public references for payload structure and exploitation steps.

Detection Methods for CVE-2025-8702

Indicators of Compromise

HTTP requests to /CommonSolution/GetVariableByOneIDNew containing SQL meta-characters in the ObjectID parameter such as single quotes, UNION, SELECT, --, or ;.
Application or database error messages logged immediately after requests to the GetVariableByOneIDNew endpoint.
Unusual database query patterns or anomalous response sizes returned to authenticated WOES sessions.

Detection Strategies

Deploy web application firewall rules that inspect the ObjectID parameter for SQL injection signatures and block requests containing common injection tokens.
Enable verbose query logging on the WOES backend database and correlate query patterns with HTTP access logs to identify malformed queries.
Monitor authentication logs for low-privilege accounts issuing repeated requests to the Historical Data Query Module.

Monitoring Recommendations

Alert on any HTTP 500 responses or database exceptions generated from the /CommonSolution/GetVariableByOneIDNew route.
Track the volume and diversity of ObjectID values per authenticated session and flag statistical outliers.
Forward WOES application and database logs to a centralized SIEM for retention and correlation.

How to Mitigate CVE-2025-8702

Immediate Actions Required

Restrict network access to the WOES management interface so that only trusted operator workstations can reach /CommonSolution/GetVariableByOneIDNew.
Audit and rotate credentials for all low-privilege WOES accounts, since exploitation requires authentication.
Review database audit logs for evidence of unauthorized queries against historical data tables.

Patch Information

At the time of publication, no vendor-supplied patch or security advisory from Wanzhou is referenced in the NVD entry. Operators should contact the vendor directly for remediation guidance and monitor the VulDB advisory for updates.

Workarounds

Place the WOES application behind a reverse proxy or WAF that filters SQL injection payloads targeting the ObjectID parameter.
Apply database-layer least privilege so the WOES application account cannot read or modify tables outside the Historical Data Query scope.
Disable or firewall the Historical Data Query Module if it is not required for production operations until a vendor fix is available.

bash

# Example WAF rule (ModSecurity) blocking SQLi patterns on the affected endpoint
SecRule REQUEST_URI "@beginsWith /CommonSolution/GetVariableByOneIDNew" \
  "chain,deny,status:403,id:1008702,msg:'CVE-2025-8702 SQLi attempt in ObjectID'"
  SecRule ARGS:ObjectID "@rx (?i)(union(\s|\+)+select|--|;|/\*|\bor\b\s+\d+=\d+|')" "t:none,t:urlDecodeUni"