CVE-2025-25991
📋 TL;DR
A SQL injection vulnerability in HooskCMS v1.7.1 allows remote attackers to extract sensitive database information through the /install/index.php component. This affects all HooskCMS v1.7.1 installations with the default installation component accessible. Attackers can exploit this without authentication to read database contents.
💻 Affected Systems
- HooskCMS
📦 What is this software?
Hoosk by Hoosk
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including user credentials, sensitive content, and potential privilege escalation leading to full system takeover.
Likely Case
Extraction of database contents including user credentials, configuration data, and sensitive CMS content.
If Mitigated
Limited information disclosure if database permissions are restricted and sensitive data is encrypted.
🎯 Exploit Status
SQL injection via /install/index.php requires no authentication. Public GitHub issue shows exploitation details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://github.com/havok89/Hoosk/issues/68
Restart Required: No
Instructions:
1. Remove or restrict access to /install/index.php
2. Implement input validation and parameterized queries
3. Monitor GitHub repository for official patch
🔧 Temporary Workarounds
Remove installation component
linuxDelete or restrict access to the vulnerable /install/index.php file
rm /path/to/hooskcms/install/index.php
chmod 000 /path/to/hooskcms/install/index.php
Web server access restriction
allConfigure web server to block access to /install directory
# Apache: Add to .htaccess
Deny from all
# Nginx: Add to server block
location /install { deny all; }
🧯 If You Can't Patch
- Implement WAF rules to block SQL injection patterns targeting /install/index.php
- Monitor and alert on access attempts to /install/index.php in web server logs
🔍 How to Verify
Check if Vulnerable:
Check if /install/index.php is accessible via browser or curl: curl -I http://target/install/index.phpCheck Version:
Check HooskCMS version in configuration files or admin panelVerify Fix Applied:
Verify /install/index.php returns 403/404 or is not accessible. Test SQL injection attempts are blocked.📡 Detection & Monitoring
Log Indicators:
- SQL syntax in GET/POST parameters to /install/index.php
- Multiple rapid requests to /install/index.php with varying parameters
Network Indicators:
- HTTP requests containing SQL keywords (SELECT, UNION, etc.) targeting /install/index.php
SIEM Query:
source="web_logs" AND (url_path="/install/index.php" AND (query="*SELECT*" OR query="*UNION*" OR query="*OR*"))