CVE-2025-55476
📋 TL;DR
FireShare FileShare 1.2.25 contains a time-based blind SQL injection vulnerability in the sort parameter of the public videos API endpoint. Attackers can inject arbitrary SQL subqueries to potentially extract sensitive database information. All instances running vulnerable versions are affected.
💻 Affected Systems
- FireShare FileShare
📦 What is this software?
Fireshare by Shaneisrael
⚠️ Risk & Real-World Impact
Worst Case
Full database compromise including extraction of user credentials, personal data, and potential lateral movement to other systems
Likely Case
Extraction of sensitive application data such as user information, file metadata, or configuration details
If Mitigated
Limited information disclosure through timing-based enumeration of database structure
🎯 Exploit Status
Time-based blind SQL injection requires specialized tools and knowledge
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.26
Vendor Advisory: https://github.com/ShaneIsrael/fireshare/releases/tag/v1.2.26
Restart Required: No
Instructions:
1. Backup your current installation. 2. Download version 1.2.26 from GitHub releases. 3. Replace the vulnerable files with patched version. 4. Verify the fix by testing the vulnerable endpoint.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to reject suspicious sort parameter values
Implement allowlist validation for sort parameter values
WAF Rule
allDeploy web application firewall rules to block SQL injection patterns
Configure WAF to block requests containing SQL keywords in sort parameter
🧯 If You Can't Patch
- Restrict access to the /api/videos/public endpoint using network controls
- Implement rate limiting to make time-based attacks impractical
🔍 How to Verify
Check if Vulnerable:
Test the endpoint with payload: /api/videos/public?sort=(SELECT+1+FROM+dual+WHERE+SLEEP(5))Check Version:
Check the application version in admin panel or configuration filesVerify Fix Applied:
Test the same payload after patching - should return immediately without delay📡 Detection & Monitoring
Log Indicators:
- Unusual SQL keywords in GET parameters
- Multiple requests with varying sort parameters causing delays
Network Indicators:
- Repeated requests to /api/videos/public with SQL-like patterns in parameters
SIEM Query:
source="web_logs" AND uri_path="/api/videos/public" AND query_string="*sort=*SELECT*" OR query_string="*sort=*SLEEP*"