CVE-2025-10105
📋 TL;DR
This SQL injection vulnerability in ChanCMS allows attackers to execute arbitrary SQL commands through the /cms/article/search endpoint by manipulating the 'keyword' parameter. Attackers can potentially access, modify, or delete database content. All ChanCMS installations up to version 3.3.1 are affected.
💻 Affected Systems
- yanyutao0402 ChanCMS
📦 What is this software?
Chancms by Chancms
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, or remote code execution if database permissions allow.
Likely Case
Unauthorized data access, data exfiltration, or privilege escalation through database manipulation.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permission restrictions.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 3.3.2 or later
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Check current ChanCMS version. 2. Download and install version 3.3.2 or later from official source. 3. Verify the /cms/article/search endpoint uses parameterized queries.
🔧 Temporary Workarounds
Input Validation Filter
allImplement strict input validation for the 'keyword' parameter to block SQL injection attempts
Add input sanitization in /cms/article/search controller
WAF Rule
allDeploy web application firewall rules to block SQL injection patterns in the keyword parameter
Configure WAF to detect and block SQL injection patterns in POST/GET parameters
🧯 If You Can't Patch
- Disable or restrict access to the /cms/article/search endpoint
- Implement network segmentation to isolate the ChanCMS instance from sensitive databases
🔍 How to Verify
Check if Vulnerable:
Test the /cms/article/search endpoint with SQL injection payloads in the keyword parameter and observe database errors or unexpected behavior.Check Version:
Check ChanCMS version in admin panel or configuration filesVerify Fix Applied:
After patching, test the same SQL injection payloads and verify they are properly sanitized or rejected.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL syntax in keyword parameter logs
- Database error messages in application logs
- Multiple rapid requests to /cms/article/search
Network Indicators:
- SQL keywords in HTTP parameters
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND uri="/cms/article/search" AND (keyword CONTAINS "UNION" OR keyword CONTAINS "SELECT" OR keyword CONTAINS "INSERT")