CVE-2025-1168
📋 TL;DR
CVE-2025-1168 is a critical SQL injection vulnerability in SourceCodester Contact Manager with Export to VCF 1.0 that allows remote attackers to execute arbitrary SQL commands via the 'contact' parameter in the /endpoint/delete-contact.php file. This affects all users running the vulnerable version of this web application, potentially leading to data theft, modification, or deletion.
💻 Affected Systems
- SourceCodester Contact Manager with Export to VCF
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data exfiltration, data destruction, privilege escalation to database administrator, and potential server takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized access to contact manager database, extraction of sensitive contact information, and potential modification or deletion of contact records.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing successful exploitation.
🎯 Exploit Status
Exploit has been publicly disclosed; SQL injection vulnerabilities are commonly weaponized with automated tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Consider implementing input validation and parameterized queries in the delete-contact.php file, or replace with a secure alternative.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns targeting the /endpoint/delete-contact.php endpoint
Input Validation Filter
allAdd input validation to only accept numeric values for the 'contact' parameter
<?php
if (!is_numeric($_POST['contact'])) {
http_response_code(400);
exit('Invalid contact ID');
}
?>
🧯 If You Can't Patch
- Isolate the vulnerable system from internet access and restrict to internal network only
- Implement strict network segmentation and monitor all traffic to/from the affected system
🔍 How to Verify
Check if Vulnerable:
Test the /endpoint/delete-contact.php endpoint with SQL injection payloads in the 'contact' parameter (e.g., contact=1' OR '1'='1)Check Version:
Check application version in admin panel or readme files; this is version 1.0 specificallyVerify Fix Applied:
Verify that SQL injection payloads no longer execute and return appropriate error responses📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in web server logs
- Multiple DELETE requests with suspicious parameter values
- Requests to /endpoint/delete-contact.php with non-numeric contact parameters
Network Indicators:
- HTTP POST requests to /endpoint/delete-contact.php containing SQL keywords (SELECT, UNION, etc.)
- Unusual database query patterns from web server IP
SIEM Query:
source="web_server_logs" AND uri_path="/endpoint/delete-contact.php" AND (request_body CONTAINS "' OR" OR request_body CONTAINS "UNION" OR request_body CONTAINS "SELECT")