CVE-2025-6009
📋 TL;DR
This is a critical SQL injection vulnerability in the like-girl software version 5.2.0. Attackers can remotely exploit the /admin/ipAddPost.php file by manipulating the bz/ipdz parameter to execute arbitrary SQL commands. Organizations using this software are at risk of data theft, modification, or deletion.
💻 Affected Systems
- kiCode111 like-girl
📦 What is this software?
Like Girl by Kicode111
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data exfiltration, privilege escalation, or system takeover
Likely Case
Unauthorized data access, modification, or deletion from the application database
If Mitigated
Limited impact due to proper input validation and database permissions
🎯 Exploit Status
Exploit requires admin access to reach the vulnerable endpoint, but SQL injection is straightforward once authenticated
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider workarounds or replacing the software.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize the bz/ipdz parameter before processing
Modify /admin/ipAddPost.php to validate and sanitize user input
Web Application Firewall
allDeploy WAF rules to block SQL injection patterns targeting the vulnerable endpoint
Configure WAF to block requests containing SQL injection patterns to /admin/ipAddPost.php
🧯 If You Can't Patch
- Restrict access to /admin/ directory using network controls or authentication
- Monitor database logs for unusual SQL queries and implement database activity monitoring
🔍 How to Verify
Check if Vulnerable:
Check if /admin/ipAddPost.php exists and accepts bz/ipdz parameter without proper input validationCheck Version:
Check software version in configuration files or admin interfaceVerify Fix Applied:
Test the vulnerable endpoint with SQL injection payloads to confirm they are blocked📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts to admin interface
- Requests to /admin/ipAddPost.php with SQL keywords
Network Indicators:
- HTTP POST requests to /admin/ipAddPost.php containing SQL injection patterns
SIEM Query:
source="web_logs" AND uri="/admin/ipAddPost.php" AND (request_body CONTAINS "UNION" OR request_body CONTAINS "SELECT" OR request_body CONTAINS "INSERT")