EUVD-2025-16731
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
Foxcms v1.25 has a SQL time injection in the $_POST['dbname'] parameter of installdb.php.
Analysis
Foxcms v1.25 contains a SQL time-based injection vulnerability in the installdb.php installation script, specifically in the $_POST['dbname'] parameter, allowing unauthenticated local attackers to execute arbitrary SQL commands and fully compromise database confidentiality, integrity, and availability. With a CVSS score of 8.4 and local attack vector, this vulnerability poses a significant risk during initial application deployment; exploitation status and POC availability should be confirmed against current threat intelligence feeds, though the high CVSS and local-only requirement suggests moderate real-world impact depending on deployment model.
Technical Context
The vulnerability stems from insufficient input sanitization in the database installation routine (installdb.php), where user-supplied input from the $_POST['dbname'] parameter is concatenated directly into SQL queries without proper parameterization or prepared statement usage. This represents a classic instance of CWE-89 (SQL Injection), specifically a time-based blind SQL injection variant where attackers infer database content through response time delays. The affected component is Foxcms v1.25 (CPE would be: cpe:2.3:a:foxcms:foxcms:1.25:*:*:*:*:*:*:*), a content management system. The installation script typically lacks the application-level authentication controls present in production code, making this an attractive attack surface for initial compromise during setup or post-deployment misconfiguration scenarios.
Affected Products
- product: Foxcms; version: 1.25; cpe: cpe:2.3:a:foxcms:foxcms:1.25:*:*:*:*:*:*:*; affected_component: installdb.php; vulnerable_parameter: $_POST['dbname']; vulnerability_type: SQL Time-Based Injection (CWE-89)
Remediation
Patching: Upgrade to Foxcms version > 1.25 if available (vendor advisory required to confirm patched version). Check official Foxcms repository or vendor security page for available patches. Immediate Mitigation: Delete or restrict access to installdb.php post-installation using filesystem permissions or web server configuration (e.g., Apache .htaccess or Nginx location block). Code-Level Fix: Implement prepared statements with parameterized queries in installdb.php: use placeholders (?) instead of string concatenation. Example: $stmt = $pdo->prepare('CREATE DATABASE ?'); $stmt->execute([$dbname]);. Validate and sanitize $_POST['dbname'] against whitelist of allowed database names (alphanumeric + underscore only). Access Control: Restrict installdb.php execution to localhost/127.0.0.1 only via web server configuration or .htaccess rules. Input Validation: Implement strict input validation: reject database names containing SQL keywords, special characters, or exceeding expected length. Use regex: ^[a-zA-Z0-9_]+$ before processing.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today