CVE-2025-8806
📋 TL;DR
This is a critical SQL injection vulnerability in zhilink ADP Application Developer Platform 1.0.0 that allows remote attackers to execute arbitrary SQL commands via the extId parameter in the /adpweb/a/sys/office/treeData endpoint. Organizations using this specific version of the ADP platform are affected and should take immediate action.
💻 Affected Systems
- zhilink ADP Application Developer Platform
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, modification, or deletion; potential remote code execution if database configuration permits.
Likely Case
Unauthorized data access and extraction from the application database, potentially including sensitive business or user information.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permission restrictions in place.
🎯 Exploit Status
Exploit details are publicly disclosed on vuldb.com. The vulnerability requires access to the affected endpoint but may not require authentication depending on application configuration.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: UNKNOWN
Vendor Advisory: NONE
Restart Required: No
Instructions:
No official patch available. Vendor did not respond to disclosure. Consider upgrading to a newer version if available or implementing workarounds.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns targeting the /adpweb/a/sys/office/treeData endpoint and extId parameter.
Input Validation Filter
allAdd server-side input validation to sanitize the extId parameter before processing.
🧯 If You Can't Patch
- Isolate the ADP platform behind a reverse proxy with strict input validation
- Implement network segmentation to limit database access from the application server
🔍 How to Verify
Check if Vulnerable:
Test the /adpweb/a/sys/office/treeData endpoint with SQL injection payloads in the extId parameter. Monitor for database errors or unexpected responses.Check Version:
Check application version through admin interface or configuration files. The vulnerable version is specifically 1.0.0.Verify Fix Applied:
After implementing workarounds, test with the same SQL injection payloads to ensure they are blocked or sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual database queries from web application
- SQL syntax errors in application logs
- Multiple requests to /adpweb/a/sys/office/treeData with unusual parameters
Network Indicators:
- HTTP requests containing SQL keywords (SELECT, UNION, etc.) in URL parameters
- Unusual traffic patterns to the vulnerable endpoint
SIEM Query:
source="web_logs" AND uri="/adpweb/a/sys/office/treeData" AND (param="extId" AND value CONTAINS "' OR ")