CVE-2025-63694
📋 TL;DR
DzzOffice v2.3.7 and earlier contains a SQL injection vulnerability in the explorer/groupmanage component that allows attackers to execute arbitrary SQL commands. This affects all organizations using vulnerable versions of DzzOffice, potentially exposing sensitive database information.
💻 Affected Systems
- DzzOffice
📦 What is this software?
Dzzoffice by Dzzoffice
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation, and potential remote code execution through database functions.
Likely Case
Unauthorized data extraction including user credentials, sensitive documents, and configuration data.
If Mitigated
Limited information disclosure if proper input validation and WAF rules are in place.
🎯 Exploit Status
Proof-of-concept code is publicly available on GitHub. Exploitation requires some authentication but is technically simple.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available, or apply workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allAdd parameter validation and sanitization to the explorer/groupmanage endpoint
Modify affected PHP files to use prepared statements with parameterized queries
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns
Add SQL injection detection rules to your WAF configuration
🧯 If You Can't Patch
- Restrict network access to DzzOffice instances using firewall rules
- Implement strict authentication and authorization controls to limit who can access the vulnerable endpoint
🔍 How to Verify
Check if Vulnerable:
Check DzzOffice version in admin panel or by examining source files. Version 2.3.7 or earlier indicates vulnerability.Check Version:
Check the version.php file or admin dashboard for version informationVerify Fix Applied:
Test the explorer/groupmanage endpoint with SQL injection payloads to confirm they are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by SQL-like payloads in web logs
Network Indicators:
- HTTP requests containing SQL keywords (SELECT, UNION, etc.) to explorer/groupmanage endpoint
SIEM Query:
source="web_logs" AND uri="/explorer/groupmanage" AND (query="SELECT" OR query="UNION" OR query="OR 1=1")