CVE-2025-56630 – FoxCMS v1.2.5 and earlier contains a SQL inject... (How to Fix)

Q: What is the severity of CVE-2025-56630?

CVE-2025-56630 has a CVSS score of 7.3 (HIGH). FoxCMS v1.2.5 and earlier contains a SQL injection vulnerability in the column_model parameter of the admin controller. This allows attackers to execute arbitrary SQL commands on the database. All FoxCMS installations using vulnerable versions are affected.

📋 TL;DR

FoxCMS v1.2.5 and earlier contains a SQL injection vulnerability in the column_model parameter of the admin controller. This allows attackers to execute arbitrary SQL commands on the database. All FoxCMS installations using vulnerable versions are affected.

💻 Affected Systems

Products:

FoxCMS

Versions: v1.2.5 and earlier

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: Requires admin panel access to exploit the column_model parameter.

📦 What is this software?

Foxcms by Foxcms

View all CVEs affecting Foxcms →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database compromise leading to data theft, data manipulation, or full system takeover via SQL injection to RCE chaining.

🟠

Likely Case

Database information disclosure, including admin credentials, user data, and configuration details.

🟢

If Mitigated

Limited impact if proper input validation and parameterized queries are implemented.

🌐 Internet-Facing: HIGH - Admin interfaces are often internet-facing in CMS deployments.

🏢 Internal Only: MEDIUM - Still significant risk if attackers gain internal network access.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW - Standard SQL injection technique once admin access is obtained.

Exploitation requires authentication to the admin panel first.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Unknown

Vendor Advisory: https://www.foxcms.cn/

Restart Required: No

Instructions:

1. Check vendor website for security updates. 2. Apply any available patches. 3. Review and sanitize all user inputs.

🔧 Temporary Workarounds

Input Validation

all

Implement strict input validation for column_model parameter

Modify app/admin/controller/Column.php to validate column_model input

WAF Rules

all

Deploy web application firewall rules to block SQL injection patterns

🧯 If You Can't Patch

Restrict admin panel access to trusted IP addresses only
Implement database user with minimal privileges for the application

🔍 How to Verify

Check if Vulnerable:

Review app/admin/controller/Column.php for unsanitized column_model parameter usage

Check Version:

Check FoxCMS version in configuration files or admin panel

Verify Fix Applied:

Test column_model parameter with SQL injection payloads after applying fixes

📡 Detection & Monitoring

Log Indicators:

Unusual SQL queries in database logs
Multiple failed login attempts to admin panel

Network Indicators:

SQL syntax in HTTP POST parameters to admin endpoints

SIEM Query:

web.url:*admin* AND (web.param:*column_model* AND web.param:*SQL* OR web.param:*UNION*)

📊 Metadata

CVE ID: CVE-2025-56630

CVSS v3 Score: 7.3 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE: CWE-89

EPSS Score: 0.03% exploit probability (6.7th percentile)

Published: September 8, 2025

Last Updated: September 8, 2025

🔗 References

https://www.foxcms.cn/ Product

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-56630, you might also want to check these: