CVE-2025-11316
📋 TL;DR
This CVE describes a SQL injection vulnerability in Tipray's Data Leakage Prevention System version 1.0. Attackers can exploit the findCategoryPage.do endpoint by manipulating the tenantId parameter to execute arbitrary SQL commands. The vulnerability is remotely exploitable and affects organizations using this specific Chinese data protection software.
💻 Affected Systems
- Tipray Data Leakage Prevention System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the DLP database including exfiltration of sensitive data, credential theft, and potential lateral movement to connected systems.
Likely Case
Data exfiltration from the DLP system, including potentially sensitive information about data protection policies and monitored data.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages or limited data exposure.
🎯 Exploit Status
Exploit details are publicly available on GitHub. The vendor has not responded to disclosure attempts.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider workarounds or system replacement.
🔧 Temporary Workarounds
Web Application Firewall Rules
allImplement WAF rules to block SQL injection patterns targeting the findCategoryPage.do endpoint
WAF-specific configuration commands
Network Segmentation
allRestrict access to the DLP system to authorized internal networks only
firewall rules to limit access to specific IP ranges
🧯 If You Can't Patch
- Isolate the DLP system from internet access and restrict to internal trusted networks only
- Implement database-level protections: use least privilege accounts, enable SQL injection protection features
🔍 How to Verify
Check if Vulnerable:
Test the findCategoryPage.do endpoint with SQL injection payloads in the tenantId parameterCheck Version:
Check system version through administrative interface or configuration filesVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and return appropriate error messages📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts or parameter manipulation in web logs
Network Indicators:
- Unusual outbound database connections from DLP system
- SQL error messages in HTTP responses
SIEM Query:
web.url:*findCategoryPage.do* AND (web.param:*tenantId* OR web.status:500)🔗 References
- https://github.com/FightingLzn9/vul/blob/main/%E5%A4%A9%E9%94%90%E6%95%B0%E6%8D%AE%E6%B3%84%E9%9C%B2%E9%98%B2%E6%8A%A4%E7%B3%BB%E7%BB%9F-8.md
- https://vuldb.com/?ctiid.327197
- https://vuldb.com/?id.327197
- https://vuldb.com/?submit.663506
- https://github.com/FightingLzn9/vul/blob/main/%E5%A4%A9%E9%94%90%E6%95%B0%E6%8D%AE%E6%B3%84%E9%9C%B2%E9%98%B2%E6%8A%A4%E7%B3%BB%E7%BB%9F-8.md
