CVE-2025-0791
📋 TL;DR
CVE-2025-0791 is a critical SQL injection vulnerability in ESAFENET CDG V5's /sdDoneDetail.jsp endpoint via the flowId parameter. This allows remote attackers to execute arbitrary SQL commands on the database. All systems running the affected ESAFENET CDG V5 software are vulnerable.
💻 Affected Systems
- ESAFENET CDG V5
📦 What is this software?
Cdg by Esafenet
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, or full system takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized database access allowing data exfiltration, privilege escalation, or application disruption.
If Mitigated
Limited impact if proper input validation, WAF rules, and database permissions are enforced.
🎯 Exploit Status
Public exploit available on GitHub, remote exploitation possible without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor was contacted but did not respond. Consider workarounds or system isolation.
🔧 Temporary Workarounds
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns targeting /sdDoneDetail.jsp and flowId parameter.
WAF-specific configuration required
Endpoint Blocking
linuxBlock access to /sdDoneDetail.jsp at network or application level.
iptables -A INPUT -p tcp --dport 80 -m string --string "/sdDoneDetail.jsp" --algo bm -j DROP
nginx: location ~ /sdDoneDetail\.jsp { deny all; }
🧯 If You Can't Patch
- Isolate affected systems from internet and restrict internal network access
- Implement strict database permissions and monitor for unusual SQL queries
🔍 How to Verify
Check if Vulnerable:
Test /sdDoneDetail.jsp endpoint with SQL injection payloads in flowId parameter (use authorized testing only).Check Version:
Check application version through admin interface or configuration files.Verify Fix Applied:
Verify WAF rules block SQL injection attempts or endpoint is inaccessible.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- HTTP requests to /sdDoneDetail.jsp with suspicious flowId values
Network Indicators:
- SQL error messages in HTTP responses
- Unusual database connection patterns
SIEM Query:
source="web_logs" AND uri="/sdDoneDetail.jsp" AND (flowId CONTAINS "'" OR flowId CONTAINS "--" OR flowId CONTAINS "UNION")