CVE-2025-55849
📋 TL;DR
WeiPHP v5.0 and earlier contains a SQL injection vulnerability in the SucaiController.class.php file via the cancelTemplatee parameter. This allows attackers to execute arbitrary SQL commands on the database. All users running vulnerable versions are affected.
💻 Affected Systems
- WeiPHP
📦 What is this software?
Weiphp by Weiphp
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, or full system takeover via subsequent attacks.
Likely Case
Unauthorized data access, extraction of sensitive information, and potential privilege escalation.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permissions in place.
🎯 Exploit Status
SQL injection via cancelTemplatee parameter requires some authentication but is straightforward to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://gitee.com/zyun4/wei-php5.0/issues/ICWO0Y
Restart Required: No
Instructions:
1. Check for official patch from WeiPHP developers. 2. If no patch, implement workarounds. 3. Consider upgrading to a newer, supported version if available.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd strict input validation for the cancelTemplatee parameter to reject malicious SQL characters.
Edit SucaiController.class.php to validate/sanitize cancelTemplatee input
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection attempts targeting this endpoint.
Configure WAF to block SQL injection patterns for /SucaiController/cancelTemplatee
🧯 If You Can't Patch
- Restrict network access to the WeiPHP application to trusted IPs only
- Implement database user with minimal necessary permissions
🔍 How to Verify
Check if Vulnerable:
Check if running WeiPHP v5.0 or earlier and examine SucaiController.class.php for vulnerable cancelTemplatee parameter handling.Check Version:
Check WeiPHP version in configuration files or admin panelVerify Fix Applied:
Test the cancelTemplatee endpoint with SQL injection payloads to ensure they are blocked or sanitized.📡 Detection & Monitoring
Log Indicators:
- SQL error messages in application logs
- Unusual database queries from web application
Network Indicators:
- HTTP requests to /SucaiController/cancelTemplatee with SQL syntax in parameters
SIEM Query:
web.url:*cancelTemplatee* AND (web.param:*UNION* OR web.param:*SELECT* OR web.param:*OR*1=1*)