CVE-2025-4541
📋 TL;DR
This critical SQL injection vulnerability in LmxCMS 1.41 allows remote attackers to execute arbitrary SQL commands via the 'sortid' parameter in POST requests to the manageZt function. Attackers can potentially read, modify, or delete database content. All users running LmxCMS 1.41 with the vulnerable component are affected.
💻 Affected Systems
- LmxCMS
📦 What is this software?
Lmxcms by Lmxcms
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, privilege escalation to admin access, and potential remote code execution if database functions allow it.
Likely Case
Unauthorized data access, data manipulation, and potential authentication bypass leading to administrative control of the CMS.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only allowing data viewing without modification.
🎯 Exploit Status
Exploit requires access to the admin interface but does not require authentication to the vulnerable function specifically. Public proof-of-concept available on GitHub.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: none
Vendor Advisory: none
Restart Required: No
Instructions:
No official patch available. Vendor did not respond to disclosure. Consider migrating to alternative CMS or implementing workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize the sortid parameter before processing
Modify c/admin/ZtAction.class.php to add: $sortid = intval($_POST['sortid']); before using the parameter in SQL queries
WAF Rule
allImplement web application firewall rules to block SQL injection patterns in POST requests
Add WAF rule to detect and block SQL injection patterns in sortid parameter
🧯 If You Can't Patch
- Restrict network access to the admin interface using IP whitelisting
- Implement database user with minimal permissions (read-only if possible)
🔍 How to Verify
Check if Vulnerable:
Check if file c/admin/ZtAction.class.php exists and contains unsanitized sortid parameter usage in SQL queriesCheck Version:
Check CMS version in configuration files or admin panelVerify Fix Applied:
Test with SQL injection payloads in sortid parameter; successful fix should return error or no database manipulation📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple POST requests to admin/ZtAction.class.php with SQL-like patterns in parameters
Network Indicators:
- POST requests containing SQL keywords (UNION, SELECT, etc.) in sortid parameter
SIEM Query:
source="web_logs" AND uri="*ZtAction.class.php*" AND (param="*sortid*UNION*" OR param="*sortid*SELECT*")