CVE-2025-6008
📋 TL;DR
This CVE describes a critical SQL injection vulnerability in kiCode111 like-girl version 5.2.0. Attackers can exploit the /admin/ImgAddPost.php file by manipulating imgDatd, imgText, or imgUrl parameters to execute arbitrary SQL commands. The vulnerability affects systems running this specific software version and can be exploited remotely without authentication.
💻 Affected Systems
- kiCode111 like-girl
📦 What is this software?
Like Girl by Kicode111
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise allowing data theft, modification, or deletion; potential for remote code execution if database permissions allow; system takeover.
Likely Case
Unauthorized data access and extraction from the database, potentially including user credentials, sensitive information, or administrative data.
If Mitigated
Limited impact due to proper input validation, parameterized queries, or database permission restrictions.
🎯 Exploit Status
Exploit details are publicly available on GitHub. The vulnerability requires no authentication and has simple exploitation vectors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available, or implement workarounds. Monitor vendor channels for updates.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation and parameterized queries for all user inputs in the affected file.
Modify /admin/ImgAddPost.php to use prepared statements with parameterized queries
Access Restriction
allRestrict access to the vulnerable endpoint using web server configuration or authentication.
Add authentication requirement or IP whitelisting for /admin/ directory
🧯 If You Can't Patch
- Implement a Web Application Firewall (WAF) with SQL injection protection rules
- Isolate the vulnerable system from critical networks and implement strict network segmentation
🔍 How to Verify
Check if Vulnerable:
Check if /admin/ImgAddPost.php exists and accepts imgDatd, imgText, or imgUrl parameters without proper input validation.Check Version:
Check software version in configuration files or admin panelVerify Fix Applied:
Test the affected parameters with SQL injection payloads to confirm they are properly sanitized or blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts or parameter manipulation in web server logs
- Unexpected database errors
Network Indicators:
- HTTP requests to /admin/ImgAddPost.php with SQL injection patterns in parameters
- Unusual database connection patterns
SIEM Query:
source="web_server" AND uri="/admin/ImgAddPost.php" AND (param="imgDatd" OR param="imgText" OR param="imgUrl") AND (content="UNION" OR content="SELECT" OR content="INSERT" OR content="DELETE")