CVE-2025-0296
📋 TL;DR
CVE-2025-0296 is a critical SQL injection vulnerability in code-projects Online Book Shop 1.0 that allows remote attackers to execute arbitrary SQL commands via the 'subcatid' parameter in /booklist.php. This affects all deployments of Online Book Shop 1.0, potentially compromising database confidentiality, integrity, and availability.
💻 Affected Systems
- code-projects Online Book Shop
📦 What is this software?
Online Book Shop by Code Projects
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, and potential remote code execution if database functions allow it.
Likely Case
Unauthorized data access, extraction of sensitive information (user credentials, payment data), and potential privilege escalation.
If Mitigated
Limited impact with proper input validation and parameterized queries in place.
🎯 Exploit Status
Exploit code is publicly available in the GitHub gist reference. Attack requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation for the subcatid parameter to only accept expected values.
Web Application Firewall Rules
allDeploy WAF rules to block SQL injection patterns targeting /booklist.php with subcatid parameter.
🧯 If You Can't Patch
- Isolate the application behind a reverse proxy with strict input filtering
- Implement network segmentation to limit database access from the application server
🔍 How to Verify
Check if Vulnerable:
Test /booklist.php with SQL injection payloads in subcatid parameter (e.g., ' OR '1'='1). Monitor for database errors or unexpected responses.Check Version:
Check application version in admin panel or configuration files.Verify Fix Applied:
Test with same payloads after implementing fixes; should receive proper error handling or sanitized responses.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple requests to /booklist.php with suspicious subcatid values
- Database query errors containing SQL syntax
Network Indicators:
- HTTP requests to /booklist.php with SQL keywords in parameters
- Unusual database connection patterns from application server
SIEM Query:
source="web_logs" AND uri="/booklist.php" AND (param="subcatid" AND value MATCHES "(?i)(union|select|insert|update|delete|drop|or|and|--|#|;)")