Overview
The Common Vulnerabilities and Exposures (CVE) system has recently identified a critical vulnerability in the Saurus CMS Community Edition 4.7.1. This vulnerability, labeled CVE-2025-50567, allows potential cybercriminals to inject user-controlled SQL statements into the system. It’s a serious concern because it affects a wide range of systems and could potentially result in arbitrary PHP code execution. PHP is a widely used language for web development, and exploiting this vulnerability could potentially compromise the entire system or lead to severe data leakage.
Vulnerability Summary
CVE ID: CVE-2025-50567
Severity: Critical (CVSS score 10.0)
Attack Vector: Network
Privileges Required: Low
User Interaction: None
Impact: System compromise, Data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Saurus CMS Community Edition | 4.7.1
How the Exploit Works
The vulnerability resides in the custom DB::prepare() function of Saurus CMS Community Edition 4.7.1. The function uses the deprecated /e (eval) modifier in the preg_replace() PHP function to interpolate SQL query parameters. This usage allows for the injection of user-controlled SQL statements. Because the preg_replace() function with the /e modifier is essentially executing PHP code, this can lead to arbitrary PHP code execution if an attacker is able to control the input.
Conceptual Example Code
Here’s an example of how an attacker might exploit this vulnerability. This is a conceptual HTTP request that sends a malicious payload to the server.
POST /db/prepare HTTP/1.1
Host: target.example.com
Content-Type: application/x-www-form-urlencoded
query={ "sql": "SELECT * FROM users WHERE username='' OR '1'='1'; DROP TABLE users; -- " }In this example, the malicious payload is an SQL statement that will always evaluate to true, allowing the attacker to see all users. The payload also includes a command to drop the “users” table, potentially deleting all user data.
Mitigation Guidance
Users of Saurus CMS Community Edition 4.7.1 are strongly advised to apply the vendor patch to mitigate this vulnerability. If the patch cannot be applied immediately, using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can provide temporary mitigation by blocking or detecting the malicious SQL queries. However, these measures are not a long-term solution and updating to the patched version should be a priority.