{"id":64299,"date":"2025-08-25T00:18:59","date_gmt":"2025-08-25T00:18:59","guid":{"rendered":""},"modified":"2025-09-15T06:48:56","modified_gmt":"2025-09-15T12:48:56","slug":"cve-2025-50567-critical-sql-injection-vulnerability-in-saurus-cms-community-edition-4-7-1","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-50567-critical-sql-injection-vulnerability-in-saurus-cms-community-edition-4-7-1\/","title":{"rendered":"CVE-2025-50567: Critical SQL Injection Vulnerability in Saurus CMS Community Edition 4.7.1<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The Common Vulnerabilities and Exposures (CVE) system has recently identified a critical vulnerability in the Saurus CMS Community Edition 4.7.1. This vulnerability, labeled CVE-2025-50567, allows potential cybercriminals to inject user-controlled SQL statements into the system. It’s a serious concern because it affects a wide range of systems and could potentially result in arbitrary PHP code<\/a> execution. PHP is a widely used language for web development, and exploiting this vulnerability could potentially compromise the entire system or lead<\/a> to severe data leakage.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-50567
\nSeverity: Critical (CVSS score 10.0)
\nAttack Vector: Network
\nPrivileges Required: Low
\nUser Interaction: None
\nImpact: System compromise, Data leakage<\/a><\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Saurus CMS Community Edition | 4.7.1<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The vulnerability resides in the custom<\/a> DB::prepare() function of Saurus CMS Community Edition 4.7.1. The function uses the deprecated \/e (eval) modifier in the preg_replace() PHP function to interpolate SQL<\/a> query parameters. This usage allows for the injection of user-controlled SQL<\/a> statements. Because the preg_replace() function with the \/e modifier is essentially executing PHP code, this can lead to arbitrary PHP code<\/a> execution if an attacker is able to control the input.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Here’s an example of how an attacker might exploit this vulnerability. This is a conceptual HTTP request that sends a malicious payload to the server<\/a>.<\/p>\n

POST \/db\/prepare HTTP\/1.1\nHost: target.example.com\nContent-Type: application\/x-www-form-urlencoded\nquery={ \"sql\": \"SELECT * FROM users WHERE username='' OR '1'='1'; DROP TABLE users; -- \" }<\/code><\/pre>\n
In this example, the malicious payload is an SQL statement that will always evaluate to true, allowing the attacker to see all users<\/a>. The payload also includes a command to drop the “users” table, potentially deleting all user data<\/a>.<\/p>\n
Mitigation Guidance<\/strong><\/p>\n
Users of Saurus CMS Community Edition<\/a> 4.7.1 are strongly advised to apply the vendor patch to mitigate this vulnerability. If the patch cannot be applied immediately, using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can provide temporary mitigation by blocking or detecting the malicious SQL queries. However, these measures are not a long-term solution and updating to the patched version should be a priority.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The Common Vulnerabilities and Exposures (CVE) system has recently identified a critical vulnerability in the Saurus CMS Community Edition 4.7.1. This vulnerability, labeled CVE-2025-50567, allows potential cybercriminals to inject user-controlled SQL statements into the system. It’s a serious concern because it affects a wide range of systems and could potentially result in arbitrary PHP […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[74],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-64299","post","type-post","status-publish","format-standard","hentry","category-uncategorized","attack_vector-sql-injection"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t