CVE-2025-5696
📋 TL;DR
This critical SQL injection vulnerability in Brilliance Golden Link Secondary System allows remote attackers to execute arbitrary SQL commands by manipulating the 'clientname' parameter in the /storagework/rentChangeCheckInfoPage.htm file. Organizations using this system up to version 20250424 are affected, potentially exposing sensitive database information.
💻 Affected Systems
- Brilliance Golden Link Secondary System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data exfiltration, modification, or deletion; potential privilege escalation to system-level access.
Likely Case
Unauthorized data access and extraction of sensitive information from the database.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data.
🎯 Exploit Status
Exploit details have been publicly disclosed on GitHub, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found in provided references
Restart Required: No
Instructions:
No official patch available. Check vendor website for updates beyond version 20250424.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns targeting the clientname parameter
Input Validation Filter
allAdd server-side input validation to sanitize the clientname parameter
🧯 If You Can't Patch
- Block external access to /storagework/rentChangeCheckInfoPage.htm via network controls
- Implement database user with minimal necessary permissions to limit potential damage
🔍 How to Verify
Check if Vulnerable:
Check if system version is 20250424 or earlier and if /storagework/rentChangeCheckInfoPage.htm exists with clientname parameterCheck Version:
Check system documentation or admin interface for version informationVerify Fix Applied:
Verify version is newer than 20250424 and test SQL injection attempts are properly blocked📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts from single IP
- Requests to /storagework/rentChangeCheckInfoPage.htm with SQL keywords in parameters
Network Indicators:
- HTTP requests containing SQL injection payloads in clientname parameter
- Unusual database connection patterns
SIEM Query:
source="web_logs" AND uri="/storagework/rentChangeCheckInfoPage.htm" AND (param="clientname" AND value CONTAINS "' OR" OR value CONTAINS "UNION" OR value CONTAINS "SELECT")