CVE-2025-8347
📋 TL;DR
This critical SQL injection vulnerability in Kehua Charging Pile Cloud Platform 1.0 allows remote attackers to execute arbitrary SQL commands via the /sys/task/findAllTask endpoint. Organizations using this charging pile management software are affected, potentially exposing sensitive data and system control.
💻 Affected Systems
- Kehua Charging Pile Cloud Platform
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, system takeover, and potential manipulation of charging infrastructure operations.
Likely Case
Unauthorized data access including customer information, charging logs, and administrative credentials.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easily weaponizable by attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: No
Instructions:
No official patch available. Consider implementing workarounds or replacing the software.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection protection rules to block malicious requests to the vulnerable endpoint.
Input Validation Filter
allImplement server-side input validation to sanitize all parameters passed to /sys/task/findAllTask.
🧯 If You Can't Patch
- Isolate the Kehua Cloud Platform from internet access and restrict to internal network only.
- Implement strict network segmentation and monitor all traffic to the vulnerable endpoint.
🔍 How to Verify
Check if Vulnerable:
Test the /sys/task/findAllTask endpoint with SQL injection payloads (use authorized testing only).Check Version:
Check application version through admin interface or configuration files.Verify Fix Applied:
Verify that SQL injection attempts no longer succeed and proper input validation is in place.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in application logs
- Multiple failed login attempts via /sys/task/findAllTask
Network Indicators:
- SQL keywords in HTTP POST/GET parameters to the vulnerable endpoint
SIEM Query:
http.url:*sys/task/findAllTask* AND (http.param:*SELECT* OR http.param:*UNION* OR http.param:*OR*)