PT-2025-44163 · Ipfire · Ipfire

Alex Williams · Published 2025-10-28 · Updated 2025-10-28 · CVE-2025-34304

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions IPFire versions prior to 2.29 (Core Update 198)

Description IPFire versions prior to 2.29 (Core Update 198) contain a SQL injection issue. An authenticated attacker can manipulate the SQL query when viewing OpenVPN connection logs through the CONNECTION NAME parameter. The application sends an HTTP POST request to the ''/cgi-bin/logs.cgi/ovpnclients.dat'' Request-URI, inserting the value of the CONNECTION NAME parameter directly into the WHERE clause without proper sanitization. This can allow an attacker to disclose sensitive information from the database.

Recommendations Update to version 2.29 (Core Update 198) or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-34304

Affected Products

Ipfire

References · 6

• https://osv.dev/vulnerability/CVE-2025-34304 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34304 · Security Note
• https://twitter.com/CVEnew/status/1983185710011052440 · Twitter Post
• https://bugzilla.ipfire.org/show_bug.cgi?id=13879 · Note
• https://vulncheck.com/advisories/ipfire-sqli-via-openvpn-connection-logs · Note
• https://ipfire.org/blog/ipfire-2-29-core-update-198-released · Patch, Vendor Advisory