CVE-2025-29181
📋 TL;DR
FOXCMS versions up to 1.25 contain a SQL injection vulnerability in the admin panel's field management functionality. Attackers can inject malicious SQL queries through the title parameter, potentially accessing or modifying database content. This affects all FOXCMS installations with the vulnerable code path accessible.
💻 Affected Systems
- FOXCMS
📦 What is this software?
Foxcms by Foxcms
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, or full system takeover via subsequent attacks.
Likely Case
Unauthorized data access, privilege escalation, or database manipulation by authenticated attackers.
If Mitigated
Limited impact if proper input validation and parameterized queries are implemented.
🎯 Exploit Status
Exploit requires admin authentication. Public proof-of-concept available in GitHub gist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
No official patch available. Implement input validation and parameterized queries in /admin/util/Field.php.
🔧 Temporary Workarounds
Input Validation Workaround
allAdd input validation to sanitize $param['title'] parameter before SQL query execution
Edit /admin/util/Field.php to add validation: if(!preg_match('/^[a-zA-Z0-9_\s]+$/', $param['title'])) { die('Invalid input'); }
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns
ModSecurity rule: SecRule ARGS:title "@detectSQLi" "id:1001,phase:2,deny,status:403"
🧯 If You Can't Patch
- Restrict access to /admin/util/Field.php via IP whitelisting or authentication requirements
- Implement database-level protections: use least privilege database accounts, enable query logging
🔍 How to Verify
Check if Vulnerable:
Check if FOXCMS version is <= 1.25 and /admin/util/Field.php exists with unsanitized $param['title'] usageCheck Version:
Check FOXCMS version in configuration files or admin panelVerify Fix Applied:
Test SQL injection payloads against the title parameter and verify they are blocked or sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts to admin panel
- Suspicious parameter values in access logs
Network Indicators:
- SQL keywords in POST requests to /admin/util/Field.php
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND uri="/admin/util/Field.php" AND (request_body CONTAINS "UNION" OR request_body CONTAINS "SELECT" OR request_body CONTAINS "INSERT")