PFire versions prior to 2.29 (Core Update 198) contain a SQL injection vulnerability that allows an authenticated attacker to manipulate the SQL query used when viewing OpenVPN connection logs via the CONNECTION_NAME parameter. When viewing a range of OpenVPN connection logs, the application issues an HTTP POST request to the Request-URI /cgi-bin/logs.cgi/ovpnclients.dat and inserts the value of the CONNECTION_NAME parameter directly into the WHERE clause without proper sanitization or parameterization. The unsanitized value can alter the executed query and be used to disclose sensitive information from the database.
| Link | Resource |
|---|---|
| https://bugzilla.ipfire.org/show_bug.cgi?id=13879 | Issue Tracking Third Party Advisory |
| https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released | Release Notes |
| https://www.vulncheck.com/advisories/ipfire-sqli-via-openvpn-connection-logs | Third Party Advisory |
Configuration 1 (hide)
|
03 Nov 2025, 17:01
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Ipfire ipfire
Ipfire |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| References | () https://bugzilla.ipfire.org/show_bug.cgi?id=13879 - Issue Tracking, Third Party Advisory | |
| References | () https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released - Release Notes | |
| References | () https://www.vulncheck.com/advisories/ipfire-sqli-via-openvpn-connection-logs - Third Party Advisory | |
| CPE | cpe:2.3:a:ipfire:ipfire:2.29:core_update186:*:*:*:*:*:* cpe:2.3:a:ipfire:ipfire:*:*:*:*:*:*:*:* cpe:2.3:a:ipfire:ipfire:2.29:core_update189:*:*:*:*:*:* cpe:2.3:a:ipfire:ipfire:2.29:core_update195:*:*:*:*:*:* cpe:2.3:a:ipfire:ipfire:2.29:core_update188:*:*:*:*:*:* cpe:2.3:a:ipfire:ipfire:2.29:core_update184:*:*:*:*:*:* cpe:2.3:a:ipfire:ipfire:2.29:core_update196:*:*:*:*:*:* cpe:2.3:a:ipfire:ipfire:2.29:core_update192:*:*:*:*:*:* cpe:2.3:a:ipfire:ipfire:2.29:core_update183:*:*:*:*:*:* cpe:2.3:a:ipfire:ipfire:2.29:core_update185:*:*:*:*:*:* cpe:2.3:a:ipfire:ipfire:2.29:core_update197:*:*:*:*:*:* cpe:2.3:a:ipfire:ipfire:2.29:core_update194:*:*:*:*:*:* cpe:2.3:a:ipfire:ipfire:2.29:core_update190:*:*:*:*:*:* cpe:2.3:a:ipfire:ipfire:2.29:core_update187:*:*:*:*:*:* cpe:2.3:a:ipfire:ipfire:2.29:core_update193:*:*:*:*:*:* cpe:2.3:a:ipfire:ipfire:2.29:core_update191:*:*:*:*:*:* |
28 Oct 2025, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Published : 2025-10-28 15:16
Updated : 2025-11-03 17:01
NVD link : CVE-2025-34304
Mitre link : CVE-2025-34304
CVE.ORG link : CVE-2025-34304
JSON object : View
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')