Create CVE-2025-9943.yaml

[tk-t0n0y]

• Added CVE-2025-9943
• References:
  • https://sec-consult.com/vulnerability-lab/advisory/unauthenticated-sql-injection-vulnerability-in-shibboleth-service-provider-sp-odbc-interface/
  • https://shibboleth.net/community/advisories/secadv_20250903.txt
  • https://nvd.nist.gov/vuln/detail/CVE-2025-9943

Template validation

• Validated with a host running a vulnerable version and/or configuration (True Positive)
• Validated with a host running a patched version and/or configuration (avoid False Positive)

Additional Details

Vulnerability Overview:
The vulnerability exists in Shibboleth Service Provider 3.5.0 and earlier when the replay cache is configured to use an SQL database via the ODBC plugin. Insufficient escaping of single quotes in the SQLString class allows for blind SQL injection through the ID attribute of SAML responses.

Detection Method:
The template uses a two-request approach to detect the vulnerability:

1. First request sends a SAML response with SQL injection payload in the ID attribute
2. Second request replays the same payload to trigger replay detection
3. If the SQL injection succeeds, the server responds with "Rejecting replayed message ID" and HTTP 500 status

Template Features:

• Dynamic UTC timestamp generation using date_time() helper to satisfy SAML time window requirements
• Boolean-based blind SQL injection payload: ID="\' OR 1=1 -- -"
• Proper URL encoding and Base64 encoding of SAML XML payload
• Consistent ID across both requests using variables

Affected Systems:

• Shibboleth Service Provider ≤ 3.5.0
• Only when configured with ODBC StorageService for ReplayCache
• Fixed in version 3.5.1

CVSS Score: 9.8 (Critical)
CWE: CWE-89 (SQL Injection)

Note: This template is crafted based on the proof-of-concept from SEC Consult's security advisory. Testing on actual vulnerable systems is recommended before merge.