CVE-2025-2132
📋 TL;DR
This critical SQL injection vulnerability in ftcms 2.1 allows remote attackers to execute arbitrary SQL commands through the name parameter in the search component. Attackers can potentially access, modify, or delete database content. All systems running ftcms 2.1 with the vulnerable admin interface exposed are affected.
💻 Affected Systems
- ftcms
📦 What is this software?
Ftcms by Ftcms
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, privilege escalation, and potential remote code execution via database functions.
Likely Case
Unauthorized data access, data exfiltration, and potential administrative account takeover.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
Exploit requires admin panel access; SQL injection is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative CMS or implementing workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize the name parameter before processing
Modify /admin/index.php/web/ajax_all_lists to validate name parameter using regex or whitelist
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns
Add WAF rule: deny requests containing SQL keywords in name parameter
🧯 If You Can't Patch
- Restrict access to admin interface using IP whitelisting or VPN
- Implement database user with minimal privileges for the application
🔍 How to Verify
Check if Vulnerable:
Test the /admin/index.php/web/ajax_all_lists endpoint with SQL injection payloads in name parameterCheck Version:
Check ftcms version in configuration files or admin panelVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and return appropriate error messages📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts to admin panel
- Requests with SQL keywords in name parameter
Network Indicators:
- Unusual outbound database connections
- Traffic patterns to admin interface from unexpected sources
SIEM Query:
source="web_logs" AND (uri="/admin/index.php/web/ajax_all_lists" AND (param="name" AND value CONTAINS "UNION" OR value CONTAINS "SELECT" OR value CONTAINS "OR"))