Executive Summary

CVE-2025-55472 is a Blind SQL Injection vulnerability in Tirreno version 0.9.5, specifically in the /admin/loadUsers API endpoint. It occurs because user-supplied input in the columns[0][data] parameter is directly used in SQL queries without proper validation or sanitization. Attackers can inject arbitrary SQL expressions into the ORDER BY clause, which does not return direct database errors but allows data extraction by observing application behavior such as response delays. For example, attackers can use time-based techniques like PostgreSQL's pg_sleep() function to infer database information, enumerate users, roles, and permissions, and potentially steal or modify sensitive data. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow authenticated attackers who have both CSRF and session tokens to execute malicious SQL queries via AJAX requests in the Tirreno application. Exploitation can lead to unauthorized data access, including enumeration of user accounts, roles, and permissions, as well as potential data theft or modification. Because it is a blind SQL injection, attackers can extract sensitive information one character at a time by observing application response delays, posing a high-severity risk to data confidentiality and integrity. [1, 2]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the /admin/loadUsers API endpoint for blind SQL injection in the columns[0][data] parameter. Since it is a blind SQL injection, detection involves sending crafted payloads that cause time delays in the response, such as using PostgreSQL's pg_sleep() function. For example, you can send an HTTP request with a payload that triggers a delay if a certain condition is true, and observe if the response time increases accordingly. A sample approach is to use curl or similar tools to send requests with payloads that inject time delays, then measure response times to confirm injection. Specific commands might include curl commands with injected parameters in the columns[0][data] field to test for time-based blind SQL injection. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include applying the security patch released in Tirreno version 0.9.6, which addresses this vulnerability. Additionally, ensure that all SQL queries, especially those involving user-supplied sorting parameters, use parameterized queries or prepared statements. Implement server-side whitelisting of allowable columns and sort directions (ASC/DESC) to prevent arbitrary input. Use database driver escaping functions or security middleware libraries (e.g., sqlstring for Node.js or psycopg2.sql for Python) to safely construct SQL queries. Restrict access to the /admin/loadUsers endpoint to authenticated users with valid CSRF and session tokens to reduce exploitation risk. [1, 2]

Useful 0 Not Useful 0