Critical SQL Injection Flaws Discovered in SIGB PMB v8.0.1.14 (CVE-2025-61167)

Overview

CVE-2025-61167 details critical SQL injection vulnerabilities identified in SIGB PMB (Public Mediatheque Benchmark) version 8.0.1.14. These vulnerabilities reside in the /opac_css/ajax_selector.php component and can be exploited via the id and datas parameters. Successful exploitation could allow attackers to execute arbitrary SQL queries, potentially leading to data breaches, modification of sensitive information, or even complete system compromise. This article provides a technical analysis, potential impact assessment, and recommended mitigation strategies.

Technical Details

The vulnerability exists due to insufficient sanitization of user-supplied input passed to the id and datas parameters in the /opac_css/ajax_selector.php file. An attacker can inject malicious SQL code into these parameters, which is then executed by the application’s database server. This allows the attacker to bypass intended security measures and directly interact with the database.

Specifically, the lack of proper input validation on the id and datas parameters within the ajax_selector.php script is the root cause. An attacker can craft a URL with manipulated parameters, such as:

/opac_css/ajax_selector.php?id=1' OR '1'='1&datas=test

This injected SQL code can be used to extract data, modify records, or even execute administrative commands on the database server.

CVSS Analysis

Currently, the CVSS score for CVE-2025-61167 is listed as N/A, indicating that the severity and exploitability metrics have not yet been fully assessed by the NVD. However, based on the nature of SQL injection vulnerabilities and the potential impact on data confidentiality, integrity, and availability, it is highly likely to be classified as a HIGH or CRITICAL severity vulnerability once assigned a CVSS score. We will update this section as soon as the official score becomes available.

*Note: Even without a CVSS score, it’s crucial to address this vulnerability promptly due to the significant risks associated with SQL injection.*

Possible Impact

The potential impact of successfully exploiting CVE-2025-61167 is significant. An attacker could:

• Gain unauthorized access to sensitive data, including user credentials, financial information, and other confidential data stored in the PMB database.
• Modify or delete data, potentially disrupting library operations and causing data loss.
• Compromise the entire system by escalating privileges and executing arbitrary code on the server.
• Use the compromised system as a launching pad for further attacks on other systems on the network.

Mitigation and Patch Steps

The recommended mitigation steps are as follows:

1. **Apply the Patch:** The most effective solution is to upgrade to a patched version of SIGB PMB that addresses the vulnerability. Refer to the SIGB PMB changelog for details on the patched version (see the references section).
2. **Input Validation and Sanitization:** If patching is not immediately possible, implement robust input validation and sanitization on the id and datas parameters in the /opac_css/ajax_selector.php file. Use parameterized queries or prepared statements to prevent SQL injection attacks.
3. **Web Application Firewall (WAF):** Deploy a Web Application Firewall (WAF) to detect and block malicious requests targeting the vulnerable component. Configure the WAF with rules to identify and prevent SQL injection attempts.
4. **Least Privilege Principle:** Ensure that the database user account used by the PMB application has only the necessary privileges. Avoid granting excessive permissions that could be exploited in case of a successful SQL injection attack.
5. **Regular Security Audits:** Conduct regular security audits and penetration testing to identify and address vulnerabilities proactively.

References

PMB Official Website
SIGB Official Website
SIGB PMB 8.0.1 Changelog (Security Section)
Proof of Concept (Gist)