CVE-2025-13123
📋 TL;DR
This CVE describes a SQL injection vulnerability in AMTT Hotel Broadband Operation System 1.0. Attackers can remotely exploit the /user/portal/get_firstdate.php endpoint by manipulating the uid parameter to execute arbitrary SQL commands. All systems running this specific software version are affected.
💻 Affected Systems
- AMTT Hotel Broadband Operation System
📦 What is this software?
Hibos by Amttgroup
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, and potential remote code execution via database functions.
Likely Case
Unauthorized data access, privilege escalation, and potential system compromise through database manipulation.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
The exploit has been published and requires minimal technical skill to execute. Remote exploitation is confirmed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor has not responded to disclosure. Consider workarounds or system replacement.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns targeting the vulnerable endpoint
WAF-specific configuration commands vary by platform
Network Access Control
linuxRestrict access to the vulnerable endpoint using firewall rules or network segmentation
iptables -A INPUT -p tcp --dport 80 -m string --string "/user/portal/get_firstdate.php" --algo bm -j DROP
🧯 If You Can't Patch
- Isolate the affected system from the internet and critical internal networks
- Implement strict input validation and parameterized queries in the application code
🔍 How to Verify
Check if Vulnerable:
Test the /user/portal/get_firstdate.php endpoint with SQL injection payloads in the uid parameterCheck Version:
Check system documentation or web interface for version informationVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and return appropriate error handling📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts from single IP
- Requests to /user/portal/get_firstdate.php with suspicious uid parameters
Network Indicators:
- Unusual outbound database connections
- SQL error messages in HTTP responses
- High volume of requests to the vulnerable endpoint
SIEM Query:
source="web_logs" AND uri="/user/portal/get_firstdate.php" AND (uid="*' OR*" OR uid="*;--*" OR uid="*UNION*" OR uid="*SELECT*" OR uid="*INSERT*")