CVE-2025-6095
📋 TL;DR
CVE-2025-6095 is a critical SQL injection vulnerability in Jasmin Ransomware 1.0.1 that allows remote attackers to execute arbitrary SQL commands via the username or password parameters in /checklogin.php. This affects anyone running this specific ransomware software version. The vulnerability could lead to authentication bypass, data theft, or ransomware deployment.
💻 Affected Systems
- codesiddhant Jasmin Ransomware
📦 What is this software?
Jasmin Ransomware by Codesiddhant
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise leading to ransomware deployment, data exfiltration, and lateral movement within the network.
Likely Case
Authentication bypass allowing unauthorized access to the ransomware control panel, potentially enabling attackers to deploy ransomware payloads.
If Mitigated
Limited impact with proper input validation and SQL injection protections in place.
🎯 Exploit Status
Exploit details are publicly available on GitHub repositories, making this easily exploitable.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None
Vendor Advisory: None
Restart Required: No
Instructions:
No official patch available. Remove the software immediately as it is malicious ransomware.
🔧 Temporary Workarounds
Remove Jasmin Ransomware
allCompletely uninstall and remove the Jasmin Ransomware software from all systems.
rm -rf /path/to/jasmin_ransomware/
Remove via system uninstaller if available
Block Access to /checklogin.php
linuxUse web server configuration to block access to the vulnerable endpoint.
# Apache: <Location "/checklogin.php"> Require all denied </Location>
# Nginx: location /checklogin.php { deny all; }
🧯 If You Can't Patch
- Isolate affected systems from network access immediately.
- Implement strict network segmentation to prevent lateral movement.
🔍 How to Verify
Check if Vulnerable:
Check if Jasmin Ransomware 1.0.1 is installed on the system and if /checklogin.php exists.Check Version:
Check installation directory or system logs for Jasmin Ransomware 1.0.1 referencesVerify Fix Applied:
Verify the software has been completely removed and /checklogin.php is no longer accessible.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in application logs
- Multiple failed login attempts followed by successful authentication
- Access to /checklogin.php with SQL injection patterns
Network Indicators:
- HTTP requests to /checklogin.php with SQL payloads in parameters
- Unusual outbound connections following authentication
SIEM Query:
source="web_logs" AND uri_path="/checklogin.php" AND (username="*' OR*" OR password="*' OR*")