CVE-2025-10387
📋 TL;DR
This SQL injection vulnerability in Jasmin Ransomware's handshake.php file allows remote attackers to execute arbitrary SQL commands by manipulating parameters like machine_name, computer_user, os, date, time, ip, location, systemid, and password. Anyone running Jasmin Ransomware versions up to 1.0.1 with the vulnerable component exposed is affected.
💻 Affected Systems
- codesiddhant Jasmin Ransomware
📦 What is this software?
Jasmin Ransomware by Codesiddhant
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, ransomware deployment, or system takeover
Likely Case
Database information disclosure, potential ransomware payload execution
If Mitigated
Limited impact with proper input validation and database permissions
🎯 Exploit Status
Exploit details publicly available on GitHub, attack can be initiated remotely without authentication
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown - vendor did not respond to disclosure
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider removing/disabling the software entirely as it is ransomware.
🔧 Temporary Workarounds
Block access to handshake.php
allPrevent external access to the vulnerable endpoint
# Web server configuration to block /handshake.php
# Firewall rule to block traffic to handshake.php
Implement WAF rules
allAdd SQL injection detection rules to web application firewall
# WAF specific rules to detect SQL injection patterns in the vulnerable parameters
🧯 If You Can't Patch
- Remove Jasmin Ransomware from all systems immediately
- Implement strict network segmentation to isolate any systems running this software
🔍 How to Verify
Check if Vulnerable:
Check if handshake.php exists and accepts the vulnerable parameters (machine_name, computer_user, os, date, time, ip, location, systemid, password) without proper input validationCheck Version:
Check software version if available, otherwise verify file existence and configurationVerify Fix Applied:
Test handshake.php endpoint with SQL injection payloads to ensure they are properly sanitized or blocked📡 Detection & Monitoring
Log Indicators:
- SQL error messages in web server logs
- Unusual database queries from handshake.php
- Multiple failed SQL injection attempts
Network Indicators:
- HTTP requests to handshake.php with SQL keywords in parameters
- Unusual traffic patterns to the ransomware endpoint
SIEM Query:
source="web_server" AND uri="/handshake.php" AND (param="machine_name" OR param="computer_user" OR param="password") AND (content="UNION" OR content="SELECT" OR content="INSERT" OR content="DELETE")