CVE-2025-1871
📋 TL;DR
A SQL injection vulnerability in 101news version 1.0 allows attackers to execute arbitrary SQL commands through the 'category' and 'subcategory' parameters in admin/add-subcategory.php. This affects all users running vulnerable versions of the 101news software, potentially compromising database integrity and confidentiality.
💻 Affected Systems
- 101news
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, privilege escalation to admin access, and potential remote code execution via database functions.
Likely Case
Unauthorized data access, modification or deletion of news content, user data exposure, and potential authentication bypass.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing SQL injection.
🎯 Exploit Status
SQL injection through GET/POST parameters is typically straightforward to exploit with common tools like sqlmap.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-101news
Restart Required: No
Instructions:
No official patch available. Implement workarounds or migrate to alternative software.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to reject malicious input in category and subcategory parameters
Modify admin/add-subcategory.php to validate parameters using regex: /^[a-zA-Z0-9_\-\s]+$/
Web Application Firewall
allDeploy WAF rules to block SQL injection patterns
Add WAF rule: SecRule ARGS "@detectSQLi" "id:1001,phase:2,deny,status:403"
🧯 If You Can't Patch
- Restrict access to admin/add-subcategory.php using IP whitelisting or authentication
- Implement database user with minimal privileges (SELECT only) for the application
🔍 How to Verify
Check if Vulnerable:
Test with sqlmap: sqlmap -u "http://target/admin/add-subcategory.php?category=test" --dbsCheck Version:
Check 101news version in admin panel or readme filesVerify Fix Applied:
Attempt SQL injection payloads like ' OR '1'='1 in category parameter and verify they are rejected📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple failed parameter validation attempts
- Admin panel access from unusual IPs
Network Indicators:
- HTTP requests with SQL keywords in parameters
- Unusual database connection patterns
SIEM Query:
source="web_logs" AND (uri="*add-subcategory.php*" AND (param="*UNION*" OR param="*SELECT*" OR param="*OR*"))