lukasz-rybak/cve-2025-65950Proof-of-concept exploit for a critical time-based blind SQL injection vulnerability in WBCE CMS, enabling low-privileged users to execute arbitrary SQL queries and exfiltrate database contents.
| Field | Details |
|---|
| CVE ID | CVE-2025-65950 |
| Severity | CRITICAL |
| Advisory | View Advisory |
| Discovered by | Lukasz Rybak |
A critical SQL Injection vulnerability in the user management module allows a low-privileged authenticated user with permissions to modify users to execute arbitrary SQL queries. This can be escalated to a full database compromise, data exfiltration, effectively bypassing all security controls.
The vulnerability exists in the admin/users/save.php script, which handles updates to user profiles. The script improperly processes the groups[] parameter sent from the user edit form.
The proof of concept involves using a time-based blind SQL injection to confirm arbitrary SQL execution.
users_modify) permissions. This user does not need to be a full administrator.
Reproduction Steps:
a. Log in as the low-privileged user. b. Navigate to "Access" -> "Users" and select any user for modification.
d. Edit `groups[]` parameter with the following URL-encoded payload, which will attempt to make the database wait for 10 seconds: groups%5B%5D=2%27+%2C+%60active%60+%3D+SLEEP(10)+--+
*(Decoded payload: 2' , `active` = SLEEP(10) -- )*
f. Send the modified request.
3. Verification:
Data Exfiltration Example: Retrieving the Database Name
**Example Payload to Test a Character:**
groups%5B%5D=2%27+%2C+%60active%60+%3D+IF(SUBSTRING(DATABASE()%2C+1%2C+1)+%3D+%27w%27%2C+SLEEP(5)%2C+0)+--+
This manual process can be continued to reveal the full database name and, subsequently, any other data in the database.
A low-privileged user, who should only be able to make benign changes to user profiles, can gain full control over the database.
The impact includes, but is not limited to:
This CVE was responsibly disclosed following coordinated vulnerability disclosure practices. The information provided here is for educational and defensive purposes only.