DobryCMS language change feature vulnerable to SQL injection
SQL injection vulnerability (CVE-2025-8536) in DobryCMS language change functionality allows attackers to execute arbitrary SQL commands through improperly sanitized user input.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated the disclosure of a SQL injection vulnerability in Studio Fabryka's DobryCMS content management system. The flaw, tracked as CVE-2025-8536, exists in the language change functionality where user-supplied input is not properly sanitized before being used in SQL queries. This improper input neutralization allows attackers to inject and execute arbitrary SQL commands against the application's database.
The vulnerability was responsibly disclosed by Dawid Radziński from RED SECURITY and coordinated through CERT Polska's vulnerability disclosure process. SQL injection vulnerabilities of this nature typically allow attackers to extract sensitive data, modify database contents, or potentially escalate privileges within the application. Organizations running DobryCMS should prioritize patching this vulnerability.
The advisory does not specify affected versions or whether patches are available, though the disclosure through CERT Polska's coordinated process suggests vendors have been notified. DobryCMS users should monitor vendor communications for security updates and apply them promptly.
Mentioned in this report
Detection guidance
Possible SQL Injection Attempt via CMS Language Parameter
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests to a language-change endpoint containing SQL injection metacharacters/keywords in the query string, consistent with CVE-2025-8536 exploitation of DobryCMS. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Possible SQL Injection Attempt via CMS Language Parameter
id: a4b2206b-d201-59ad-8da1-832f6394af32
status: experimental
description: 'Detects HTTP requests targeting a language-change or locale-switch endpoint
that contain
SQL injection style payloads (quotes, UNION SELECT, boolean/time-based operators,
comment
sequences) in the query string or POST body. This matches the exploitation pattern
described for CVE-2025-8536 in DobryCMS, where the language-change functionality
fails
to sanitize user-supplied input before use in SQL queries.
'
author: Vorant
tags:
- attack.t1190
- cve.2025-8536
logsource:
category: webserver
detection:
selection_endpoint:
cs-uri-stem|contains:
- /lang
- /language
- /locale
- changelang
- setlang
- switchlang
selection_sqli_pattern:
cs-uri-query|contains:
- ''' OR '
- ''' AND '
- UNION SELECT
- UNION ALL SELECT
- SLEEP(
- BENCHMARK(
- --
- /*
- 1=1
- '%27'
- '%20OR%20'
- '%20AND%20'
condition: selection_endpoint and selection_sqli_pattern
falsepositives:
- Security scanners or vulnerability assessment tools intentionally probing the language
endpoint
- Legitimate locale strings that coincidentally contain reserved SQL keywords (rare)
level: high
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2025/10/CVE-2025-8536
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs