CVE-2022-25125
📋 TL;DR
MCMS v5.2.4 contains a SQL injection vulnerability in the search.do endpoint at /mdiy/dict/listExcludeApp. This allows attackers to execute arbitrary SQL commands on the database. Any organization running this specific version of MCMS is affected.
💻 Affected Systems
- MCMS
📦 What is this software?
Mcms by Mingsoft
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, or full system takeover via subsequent attacks.
Likely Case
Unauthorized data access, extraction of sensitive information, or database manipulation.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage.
🎯 Exploit Status
SQL injection via search.do parameter requires minimal technical skill to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v5.2.5 or later
Vendor Advisory: https://gitee.com/mingSoft/MCMS/issues/I4TGYI
Restart Required: Yes
Instructions:
1. Backup database and application files. 2. Upgrade to MCMS v5.2.5 or later. 3. Restart the application server. 4. Verify the fix by testing the vulnerable endpoint.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection rules to block malicious requests.
Input Validation Filter
allImplement server-side input validation to sanitize search parameters.
🧯 If You Can't Patch
- Restrict network access to the MCMS application to trusted IPs only.
- Disable or block access to the /mdiy/dict/listExcludeApp endpoint via web server configuration.
🔍 How to Verify
Check if Vulnerable:
Check if running MCMS v5.2.4 and test the /mdiy/dict/listExcludeApp endpoint with SQL injection payloads.Check Version:
Check MCMS version in application configuration or admin panel.Verify Fix Applied:
Confirm version is v5.2.5 or later and retest the endpoint with SQL injection payloads to ensure they are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts or parameter manipulation in web logs
Network Indicators:
- HTTP requests to /mdiy/dict/listExcludeApp with SQL keywords in parameters
SIEM Query:
source="web_logs" AND uri="/mdiy/dict/listExcludeApp" AND (param CONTAINS "UNION" OR param CONTAINS "SELECT" OR param CONTAINS "OR 1=1")