# SQL injection vulnerability (CVE-2025-8536) in DobryCMS language change functionality…

Published: 2025-10-24 · Severity: high
Canonical: https://vorant.io/reports/1e7759e3-ca45-494b-bee3-f5dde6cbacf6/sql-injection-vulnerability-cve-2025-8536-in-dobrycms-language-change

> SQL injection vulnerability (CVE-2025-8536) in DobryCMS language change functionality allows attackers to execute arbitrary SQL commands through improperly sanitized user input.

CERT Polska coordinated the disclosure of a SQL injection vulnerability in Studio Fabryka's DobryCMS content management system. The flaw, tracked as CVE-2025-8536, exists in the language change functionality where user-supplied input is not properly sanitized before being used in SQL queries. This improper input neutralization allows attackers to inject and execute arbitrary SQL commands against the application's database.

The vulnerability was responsibly disclosed by Dawid Radziński from RED SECURITY and coordinated through CERT Polska's vulnerability disclosure process. SQL injection vulnerabilities of this nature typically allow attackers to extract sensitive data, modify database contents, or potentially escalate privileges within the application. Organizations running DobryCMS should prioritize patching this vulnerability.

The advisory does not specify affected versions or whether patches are available, though the disclosure through CERT Polska's coordinated process suggests vendors have been notified. DobryCMS users should monitor vendor communications for security updates and apply them promptly.

## Mentioned in this report

- Vulnerabilities: CVE-2025-8536

## Detection guidance (public sample)

### Possible SQL Injection Attempt via CMS Language Parameter

ATT&CK: T1190

Detects HTTP requests to a language-change endpoint containing SQL injection metacharacters/keywords in the query string, consistent with CVE-2025-8536 exploitation of DobryCMS. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Possible SQL Injection Attempt via CMS Language Parameter
id: a4b2206b-d201-59ad-8da1-832f6394af32
status: experimental
description: 'Detects HTTP requests targeting a language-change or locale-switch endpoint
  that contain

  SQL injection style payloads (quotes, UNION SELECT, boolean/time-based operators,
  comment

  sequences) in the query string or POST body. This matches the exploitation pattern

  described for CVE-2025-8536 in DobryCMS, where the language-change functionality
  fails

  to sanitize user-supplied input before use in SQL queries.

  '
references:
- https://cert.pl (CVE-2025-8536 advisory)
author: Vorant
tags:
- attack.t1190
- cve.2025-8536
logsource:
  category: webserver
  product: generic
detection:
  selection_endpoint:
    cs-uri-stem|contains:
    - /lang
    - /language
    - /locale
    - changelang
    - setlang
    - switchlang
  selection_sqli_pattern:
    cs-uri-query|contains:
    - ''' OR '
    - ''' AND '
    - UNION SELECT
    - UNION ALL SELECT
    - SLEEP(
    - BENCHMARK(
    - --
    - /*
    - 1=1
    - '%27'
    - '%20OR%20'
    - '%20AND%20'
  condition: selection_endpoint and selection_sqli_pattern
falsepositives:
- Security scanners or vulnerability assessment tools intentionally probing the language
  endpoint
- Legitimate locale strings that coincidentally contain reserved SQL keywords (rare)
level: high
```

### SQL Error Disclosure Following Language Parameter Manipulation

ATT&CK: T1190

Detects HTTP responses with database/SQL error signatures returned shortly after requests to a CMS language-change endpoint, indicating a possible successful SQL injection probe against CVE-2025-8536. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SQL Error Disclosure Following Language Parameter Manipulation
id: 617dd7bb-091d-5cf9-82de-c4c44a9bc449
status: experimental
description: 'Detects webserver responses containing common SQL/database error strings
  (syntax error,

  mysql_fetch, ODBC, SQLSTATE, etc.) served in response to requests that targeted
  a

  language-change endpoint, suggesting the SQL injection point in DobryCMS (CVE-2025-8536)

  was successfully triggered and error-based enumeration is occurring.

  '
references:
- https://cert.pl (CVE-2025-8536 advisory)
author: Vorant
tags:
- attack.t1190
- cve.2025-8536
logsource:
  category: webserver
  product: generic
detection:
  selection_endpoint:
    cs-uri-stem|contains:
    - /lang
    - /language
    - /locale
    - changelang
    - setlang
  selection_sql_error:
    sc-response-body|contains:
    - SQL syntax
    - mysql_fetch
    - You have an error in your SQL syntax
    - ODBC SQL
    - SQLSTATE
    - PostgreSQL query failed
    - 'Warning: mysql'
    - Unclosed quotation mark
  condition: selection_endpoint and selection_sql_error
falsepositives:
- Application misconfiguration unrelated to attack causing benign SQL error leakage
- Automated QA/regression tests hitting the language endpoint with malformed input
level: high
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2025/10/CVE-2025-8536

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/1e7759e3-ca45-494b-bee3-f5dde6cbacf6/sql-injection-vulnerability-cve-2025-8536-in-dobrycms-language-change.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup