VORANT. Threat Intelligence Sign in Get the full feed

Pro3W CMS Login Bypass via SQL Injection

medium vulnerability

An unauthenticated SQL injection flaw in Pro3W CMS lets attackers bypass login and gain admin access.

CERT Polska coordinated disclosure of CVE-2025-15498, a SQL injection vulnerability in Pro3W CMS affecting version 1.2.0. The flaw stems from improper sanitization of input submitted through the login form, allowing an unauthenticated attacker to bypass authentication entirely and obtain administrative privileges on affected installations.

CERT Polska notes that the vendor did not respond during the coordination process, so the exact range of affected versions could not be confirmed. However, the issue is expected to be fixed in versions released from January 2026 onward. The vulnerability was reported by researcher Jacek Czepil and disclosed through CERT Polska's coordinated vulnerability disclosure process. There is no indication of active exploitation in the wild at this time.

Mentioned in this report

Vulnerabilities CVE-2025-15498

Related reporting

Detection guidance

Pro3W CMS Login Form SQL Injection Attempt

ATT&CK T1190

Detects SQL injection payloads in Pro3W CMS login form parameters - common exploitation pattern for authentication bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Pro3W CMS Login Form SQL Injection Attempt
description: Detects SQL injection syntax in POST requests to Pro3W CMS login endpoints,
  targeting authentication bypass via improper input sanitization.
tags:
- attack.t1190
logsource:
  category: proxy
  product: generic
detection:
  selection:
    http_method: POST
    uri|contains:
    - /login
    - /user/login
    - /admin/login
    host|contains: pro3w
    http_request_body|contains:
    - ''' OR '''
    - ''' OR 1=1'
    - ''' AND '''
    - ''' UNION'
    - '''; DROP'
    - ''' HAVING 1=1'
  condition: selection
falsepositives:
- Security researchers or authorized penetration testers probing the application
- Web application firewalls generating test traffic logs
level: high
id: 3af47277-e865-5540-bbca-5fe8812da3b6
status: experimental
author: Vorant

Pro3W CMS Unauthenticated Administrative Action Post-Login Bypass

ATT&CK T1190

Detects administrative actions (user creation, configuration changes) performed without valid session authentication - indicator of successful login bypass exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Pro3W CMS Unauthenticated Administrative Action Post-Login Bypass
description: Detects administrative operations in Pro3W CMS performed with invalid
  or missing session tokens, suggesting successful SQL injection authentication bypass
  and privilege escalation.
tags:
- attack.t1190
logsource:
  category: proxy
  product: generic
detection:
  selection_admin_action:
    host|contains: pro3w
    uri|contains:
    - /admin/user/create
    - /admin/user/add
    - /admin/config
    - /admin/settings
    - /admin/manage
    http_method: POST
  selection_no_auth:
    http_request_headers|contains:
    - Cookie|not\s+\S+=
    - Authorization|not\s+Bearer
  condition: selection_admin_action and selection_no_auth
falsepositives:
- Misconfigured proxy logs omitting session header fields
- API endpoints intentionally designed for unauthenticated operations
level: medium
id: e22b1c43-e33d-59f0-bf63-94b9847d56db
status: experimental
author: Vorant

Pro3W CMS HTTP Response 200 After Failed Authentication Attempt

ATT&CK T1190

Detects successful HTTP responses on login endpoints when SQL injection syntax is submitted - anomalous behavior indicating authentication bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Pro3W CMS HTTP Response 200 After SQL Injection Login Attempt
description: Detects Pro3W CMS login endpoint returning HTTP 200 success when SQL
  injection payloads are submitted, indicative of authentication bypass exploitation.
tags:
- attack.t1190
logsource:
  category: proxy
  product: generic
detection:
  selection:
    host|contains: pro3w
    uri|contains:
    - /login
    - /user/login
    - /admin/login
    http_method: POST
    http_request_body|contains:
    - ''' OR '''
    - ''' OR 1=1'
    - ''' AND '''
    - ''' UNION'
    - '''; DROP'
    http_status: 200
  filter_error_page:
    http_response_body|contains:
    - error
    - failed
    - invalid
    - denied
  condition: selection and not filter_error_page
falsepositives:
- Verbose error pages returning HTTP 200 with error text in body
- Web application generating success pages before redirect
level: high
id: 62d16c0e-88e3-5431-bd9e-30635e3e9773
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/02/CVE-2025-15498

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free