CVE-2025-51667

Vulnerability

Overview

The /sys-api/role/update endpoint in simple-admin-core versions 1.2.0 through 1.6.7 contains a limited SQL injection vulnerability. The root cause is that the code parameter is directly concatenated into SQL statements targeting the casbin_rules table without proper sanitization [1][3]. However, the system restricts the code value to a maximum of 20 characters, which limits the exploit's scope [3].

Exploitation

Conditions

An attacker must be authenticated to reach the vulnerable endpoint, as the request requires a valid Bearer token [3]. The injection occurs in the role/update operation, where the attacker can manipulate the code field. Due to the 20-character length limit, direct exploitation is constrained, but a secondary injection scenario is possible: an attacker could first create a user with a crafted code containing the latter half of an SQL statement, then trigger the update to combine two 20-character segments into a 40-character payload [3]. This could be used to exfiltrate data from the casbin_rules table or modify its contents.

Impact

Successful exploitation could lead to partial data leakage from the casbin_rules table, which stores role-based access control rules. Additionally, an attacker could disrupt normal system operations by modifying table data or potentially launching a MySQL DDoS attack by sending multiple requests with long-sleep queries to exhaust database thread pools [3]. The impact is limited by the character restriction and the lack of a direct interface to view the casbin_rules table contents [3].

Mitigation

As of the publication date, no patch has been released. Users are advised to upgrade to a version beyond 1.6.7 once available, or apply input validation and parameterized queries to the code field as a workaround. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog.