CVE-2025-34304 Details
Description
IPFire versions prior to 2.29 (Core Update 198) contain a SQL injection vulnerability that allows an authenticated attacker to manipulate the SQL query used when viewing OpenVPN connection logs via the CONNECTION_NAME parameter. When viewing a range of OpenVPN connection logs, the application issues an HTTP POST request to the Request-URI /cgi-bin/logs.cgi/ovpnclients.dat and inserts the value of the CONNECTION_NAME parameter directly into the WHERE clause without proper sanitization or parameterization. The unsanitized value can alter the executed query and be used to disclose sensitive information from the database.
A SQL injection vulnerability has been identified in IPFire versions prior to 2.29 (Core Update 198). This vulnerability allows authenticated attackers to manipulate SQL queries when viewing OpenVPN connection logs, specifically through the CONNECTION_NAME parameter. The issue arises because the application fails to properly sanitize or parameterize the CONNECTION_NAME value before inserting it into the SQL query's WHERE clause. As a result, attackers can exploit this flaw to alter the query execution and potentially access sensitive database information.
Users are advised to update to IPFire version 2.29 (Core Update 198) or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Oct 28, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://bugzilla.ipfire.org/show_bug.cgi?id=13879 | [email protected] | Issue TrackingThird Party Advisory |
| https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released | [email protected] | Release Notes |
| https://www.vulncheck.com/advisories/ipfire-sqli-via-openvpn-connection-logs | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ipfire ipfire | < 2.29 2.29 core_update183 2.29 core_update184 2.29 core_update185 2.29 core_update186 2.29 core_update187 2.29 core_update188 2.29 core_update189 2.29 core_update190 2.29 core_update191 2.29 core_update192 2.29 core_update193 2.29 core_update194 2.29 core_update195 2.29 core_update196 2.29 core_update197 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2025 | Initial Analysis | [email protected] |
| Oct 28, 2025 | New CVE Received | [email protected] |