CVE-2025-4353
📋 TL;DR
A critical SQL injection vulnerability exists in Brilliance Golden Link Secondary System through the /paraframework/queryTsDictionaryType.htm endpoint. Attackers can remotely exploit this by manipulating the dictCn1 parameter to execute arbitrary SQL commands. This affects all versions up to 20250424.
💻 Affected Systems
- Brilliance Golden Link Secondary System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, authentication bypass, and potential remote code execution via database functions.
Likely Case
Unauthorized data access, data exfiltration, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
Public proof-of-concept available on GitHub demonstrates exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
No official patch available. Check vendor website for updates.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns targeting the vulnerable endpoint.
Network Access Control
allRestrict access to the vulnerable endpoint using firewall rules or network segmentation.
🧯 If You Can't Patch
- Implement input validation and parameterized queries in the application code
- Disable or block access to the /paraframework/queryTsDictionaryType.htm endpoint
🔍 How to Verify
Check if Vulnerable:
Test the /paraframework/queryTsDictionaryType.htm endpoint with SQL injection payloads in the dictCn1 parameter.Check Version:
Check system version in administration interface or configuration files.Verify Fix Applied:
Verify that SQL injection attempts no longer succeed and that input validation is properly implemented.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts following SQL injection patterns
- Access to /paraframework/queryTsDictionaryType.htm with suspicious parameters
Network Indicators:
- HTTP requests to vulnerable endpoint with SQL keywords in parameters
- Unusual outbound database connections from web server
SIEM Query:
source="web_logs" AND uri="/paraframework/queryTsDictionaryType.htm" AND (param="dictCn1" AND value CONTAINS "UNION" OR value CONTAINS "SELECT" OR value CONTAINS "OR 1=1")🔗 References
- https://github.com/eeeeeekkkkkkkk/POC/blob/main/%E9%BB%84%E9%87%91%E9%80%9A%E4%BA%8C%E7%BA%A7%E7%B3%BB%E7%BB%9F%E4%B8%89%E4%BB%A3%E7%AE%A1%E7%90%86%E7%AB%AF%E7%B3%BB%E7%BB%9FqueryTsDictionaryType%E6%8E%A5%E5%8F%A3%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5.md
- https://vuldb.com/?ctiid.307470
- https://vuldb.com/?id.307470
- https://vuldb.com/?submit.564593
