CVE-2025-11315
๐ TL;DR
This CVE describes a SQL injection vulnerability in Tipray's Data Leakage Prevention System version 1.0. Attackers can exploit the findUserPage.do endpoint by manipulating the 'sort' parameter to execute arbitrary SQL commands. Organizations using this specific version of the DLP system are affected.
๐ป Affected Systems
- Tipray ๅฆ้จๅคฉ้็งๆ่กไปฝๆ้ๅ ฌๅธ Data Leakage Prevention System ๅคฉ้ๆฐๆฎๆณ้ฒ้ฒๆค็ณป็ป
๐ฆ What is this software?
โ ๏ธ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data exfiltration, privilege escalation, or system takeover
Likely Case
Unauthorized data access, potential credential theft, and data manipulation
If Mitigated
Limited impact with proper input validation and database permissions
๐ฏ Exploit Status
Proof of concept is publicly available on GitHub. The vendor has not responded to disclosure attempts.
๐ ๏ธ Fix & Mitigation
โ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider workarounds or system replacement.
๐ง Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns targeting the findUserPage.do endpoint
Input Validation Filter
allAdd input validation for the sort parameter to only allow expected values
๐งฏ If You Can't Patch
- Isolate the DLP system in a separate network segment with strict access controls
- Implement database-level protections: use least privilege accounts, enable SQL injection protection features
๐ How to Verify
Check if Vulnerable:
Test the findUserPage.do endpoint with SQL injection payloads in the sort parameterCheck Version:
Check system version through admin interface or configuration filesVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and return appropriate error messages๐ก Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts from findUserPage.do
- SQL syntax errors in application logs
Network Indicators:
- Unusual traffic patterns to findUserPage.do endpoint
- SQL keywords in HTTP parameters
SIEM Query:
source="web_logs" AND uri="*findUserPage.do*" AND (param="*sort=*UNION*" OR param="*sort=*SELECT*" OR param="*sort=*INSERT*")๐ References
- https://github.com/FightingLzn9/vul/blob/main/%E5%A4%A9%E9%94%90%E6%95%B0%E6%8D%AE%E6%B3%84%E9%9C%B2%E9%98%B2%E6%8A%A4%E7%B3%BB%E7%BB%9F-7.md
- https://github.com/FightingLzn9/vul/blob/main/%E5%A4%A9%E9%94%90%E6%95%B0%E6%8D%AE%E6%B3%84%E9%9C%B2%E9%98%B2%E6%8A%A4%E7%B3%BB%E7%BB%9F-7.md#3-proof-of-concept-poc
- https://vuldb.com/?ctiid.327196
- https://vuldb.com/?id.327196
- https://vuldb.com/?submit.663494
