CVE-2025-8123
📋 TL;DR
This critical SQL injection vulnerability in deerwms deer-wms-2 allows remote attackers to execute arbitrary SQL commands via the 'ancestors' parameter in the /system/dept/edit endpoint. Organizations using deer-wms-2 versions up to 3.3 are affected, potentially exposing sensitive database information.
💻 Affected Systems
- deerwms deer-wms-2
📦 What is this software?
Deer Wms 2 by Deerwms
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, privilege escalation, and potential remote code execution via database functions.
Likely Case
Unauthorized data access, extraction of sensitive information from the database, and potential system compromise.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
Exploit details are publicly disclosed and the vulnerability is remotely exploitable without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://gitee.com/deerwms/deer-wms-2/issues/ICLRFL
Restart Required: Yes
Instructions:
1. Monitor the vendor repository for patches. 2. Apply any available security updates. 3. Restart the application service after patching.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns targeting the /system/dept/edit endpoint
Endpoint Restriction
linuxBlock external access to /system/dept/edit endpoint using network controls
iptables -A INPUT -p tcp --dport [APP_PORT] -m string --string "/system/dept/edit" --algo bm -j DROP
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries for the ancestors parameter
- Deploy network segmentation to isolate the deer-wms-2 application from sensitive systems
🔍 How to Verify
Check if Vulnerable:
Check if deer-wms-2 version is 3.3 or earlier and the /system/dept/edit endpoint is accessibleCheck Version:
Check application configuration files or admin interface for version informationVerify Fix Applied:
Verify the application version is above 3.3 and test the /system/dept/edit endpoint with SQL injection payloads📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in application logs
- Multiple failed login attempts following SQL injection patterns
- Access to /system/dept/edit with suspicious parameters
Network Indicators:
- HTTP requests to /system/dept/edit containing SQL keywords in parameters
- Unusual database connection patterns from application server
SIEM Query:
source="application.logs" AND ("system/dept/edit" AND ("UNION" OR "SELECT" OR "INSERT" OR "DELETE" OR "UPDATE"))