CVE-2025-2112
📋 TL;DR
This is a critical SQL injection vulnerability in the user-xiangpeng yaoqishan software that allows remote attackers to execute arbitrary SQL commands via the typeId parameter in the getMediaLisByFilter function. The vulnerability affects all versions up to commit a47fec4a31cbd13698c592dfdc938c8824dd25e4, and the exploit has been publicly disclosed.
💻 Affected Systems
- user-xiangpeng yaoqishan
📦 What is this software?
Yaoqishan by User Xiangpeng
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, and potential remote code execution if database permissions allow.
Likely Case
Unauthorized data access, data exfiltration, and potential privilege escalation through database manipulation.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permission restrictions.
🎯 Exploit Status
Exploit code is publicly available on GitHub, making this easily exploitable by attackers with basic SQL injection knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown - vendor did not respond to disclosure
Vendor Advisory: None available
Restart Required: Yes
Instructions:
No official patch available. Consider migrating to a different solution or implementing the workarounds below.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation for the typeId parameter to only accept expected values
Modify MediaInfoService.java to validate typeId parameter before use
Web Application Firewall (WAF)
allDeploy WAF with SQL injection rules to block malicious requests
Configure WAF to block SQL injection patterns in typeId parameter
🧯 If You Can't Patch
- Isolate the affected system from the internet and restrict network access
- Implement database-level controls: use least privilege accounts, enable audit logging
🔍 How to Verify
Check if Vulnerable:
Check if your deployment uses code from commit a47fec4a31cbd13698c592dfdc938c8824dd25e4 or earlier. Test with SQL injection payloads in typeId parameter.Check Version:
git log --oneline -1 (to check current commit hash)Verify Fix Applied:
Verify that SQL injection attempts in the typeId parameter are properly blocked or sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts or parameter manipulation in application logs
Network Indicators:
- SQL keywords in HTTP parameters (SELECT, UNION, etc.)
- Unusual database connection patterns
SIEM Query:
source="web_logs" AND (typeId CONTAINS "UNION" OR typeId CONTAINS "SELECT" OR typeId CONTAINS "--")