CVE-2025-10122
📋 TL;DR
This SQL injection vulnerability in Maccms10 allows attackers to manipulate database queries through the 'where' parameter in the 'rep' function. Attackers can potentially read, modify, or delete database content. All users running the affected Maccms10 version are vulnerable to remote exploitation.
💻 Affected Systems
- Maccms10
📦 What is this software?
Maccms by Maccms
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, or potential remote code execution via database functions.
Likely Case
Unauthorized data access, data exfiltration, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation and database permission restrictions in place.
🎯 Exploit Status
Exploit details are publicly available. Requires authentication to admin panel.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor for updated version
Vendor Advisory: Not provided in references
Restart Required: No
Instructions:
1. Check Maccms10 official website for security updates. 2. Apply the latest patch. 3. Verify the Database.php file has been updated.
🔧 Temporary Workarounds
Input Validation Workaround
allAdd parameter validation to the 'where' parameter in Database.php
Modify application/admin/controller/Database.php to validate/sanitize the 'where' parameter
Database Permission Restriction
databaseLimit database user permissions to read-only where possible
ALTER USER 'maccms_user'@'localhost' WITH GRANT OPTION;
REVOKE DROP, CREATE, ALTER ON maccms_db.* FROM 'maccms_user'@'localhost';
🧯 If You Can't Patch
- Implement web application firewall (WAF) with SQL injection rules
- Restrict admin panel access to trusted IP addresses only
🔍 How to Verify
Check if Vulnerable:
Check if your Maccms10 version is 2025.1000.4050 and review Database.php for vulnerable 'rep' functionCheck Version:
Check Maccms10 admin panel or config files for version informationVerify Fix Applied:
Test the 'rep' function with SQL injection payloads to ensure they are blocked📡 Detection & Monitoring
Log Indicators:
- Unusual database queries from admin panel
- Multiple failed SQL injection attempts in logs
Network Indicators:
- SQL syntax in HTTP POST parameters to Database.php
- Unusual database connection patterns
SIEM Query:
source="web_logs" AND (uri="/admin/Database/rep" AND (param="where" CONTAINS "UNION" OR param="where" CONTAINS "SELECT"))