CVE-2025-8220
📋 TL;DR
This SQL injection vulnerability in Engeman Web allows attackers to execute arbitrary SQL commands via the LanguageCombobox cookie parameter on the password recovery page. Attackers can exploit this remotely to potentially access, modify, or delete database content. Organizations using Engeman Web up to version 12.0.0.2 are affected.
💻 Affected Systems
- Engeman Web
📦 What is this software?
Web by Engeman
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, authentication bypass, privilege escalation, or full system takeover.
Likely Case
Unauthorized data access, credential harvesting, or database manipulation leading to further attacks.
If Mitigated
Limited impact with proper input validation, WAF rules, and database permissions in place.
🎯 Exploit Status
Public exploit code is available, making this easily weaponizable by attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 12.0.0.3
Vendor Advisory: Not provided by vendor
Restart Required: Yes
Instructions:
1. Download Engeman Web version 12.0.0.3 or later. 2. Backup current installation and database. 3. Stop the Engeman Web service. 4. Install the updated version. 5. Restart the service. 6. Verify functionality.
🔧 Temporary Workarounds
WAF Rule Implementation
allImplement web application firewall rules to block SQL injection patterns in cookie parameters.
WAF-specific configuration required
Disable Password Recovery
allTemporarily disable the password recovery functionality if not essential.
Application-specific configuration required
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries for all cookie parameters
- Deploy network segmentation and restrict access to Engeman Web instances
🔍 How to Verify
Check if Vulnerable:
Check if Engeman Web version is 12.0.0.2 or earlier and has /Login/RecoveryPass endpoint accessible.Check Version:
Check application version in admin interface or configuration files.Verify Fix Applied:
Verify installation of version 12.0.0.3 or later and test that SQL injection attempts are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in application logs
- Multiple failed login attempts from password recovery page
- Suspicious cookie values containing SQL syntax
Network Indicators:
- HTTP requests to /Login/RecoveryPass with SQL injection patterns in cookies
- Unusual database connection patterns
SIEM Query:
source="engeman_web" AND (url="/Login/RecoveryPass" AND cookie="*SELECT*" OR cookie="*UNION*" OR cookie="*OR*1=1*")