CVE-2025-11902
📋 TL;DR
This SQL injection vulnerability in ChanCMS allows remote attackers to execute arbitrary SQL commands by manipulating the 'cid' parameter in the findField function. Affected systems are ChanCMS installations up to version 3.3.2 that have the vulnerable endpoint exposed. The vulnerability can lead to data theft, modification, or complete system compromise.
💻 Affected Systems
- yanyutao0402 ChanCMS
📦 What is this software?
Chancms by Chancms
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data exfiltration, data manipulation, privilege escalation, and potential remote code execution via database functions.
Likely Case
Unauthorized data access and extraction from the ChanCMS database, potentially exposing sensitive content, user information, or administrative credentials.
If Mitigated
Limited impact with proper input validation and database permissions, potentially resulting in error messages but no data compromise.
🎯 Exploit Status
Exploit details are publicly available in GitHub repositories. The vulnerability requires no authentication and can be exploited remotely.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available as vendor did not respond. Consider upgrading to any version above 3.3.2 if available, or implement workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allImplement strict input validation for the 'cid' parameter to only accept expected data types and ranges
Modify /cms/article/findField to validate cid parameter using is_numeric() or similar validation
Web Application Firewall Rule
allBlock SQL injection attempts targeting the vulnerable endpoint
WAF rule: Block requests to /cms/article/findField containing SQL keywords in parameters
🧯 If You Can't Patch
- Restrict access to /cms/article/findField endpoint using network ACLs or authentication
- Implement database-level protections: use least privilege database accounts, enable query logging
🔍 How to Verify
Check if Vulnerable:
Check if ChanCMS version is 3.3.2 or earlier and if /cms/article/findField endpoint is accessibleCheck Version:
Check CMS version in admin panel or configuration filesVerify Fix Applied:
Test the vulnerable endpoint with SQL injection payloads to confirm they are blocked or properly handled📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple requests to /cms/article/findField with suspicious parameters
- Database error messages containing SQL syntax
Network Indicators:
- HTTP requests to /cms/article/findField containing SQL keywords like UNION, SELECT, INSERT
SIEM Query:
source="web_logs" AND uri="/cms/article/findField" AND (param="cid" AND value CONTAINS "' OR ")🔗 References
- https://github.com/NarcherAlter/Security_Note/blob/main/Vulnerability_Discovery/ChanCMSv3.3.2.md
- https://github.com/NarcherAlter/Security_Note/blob/main/Vulnerability_Discovery/ChanCMSv3.3.2.md#cmsarticlefindfield
- https://vuldb.com/?ctiid.328912
- https://vuldb.com/?id.328912
- https://vuldb.com/?submit.670262
