CVE-2025-67509: 
PHP vulnerability analysis and mitigation

CVE-2025-67509 is a read-only bypass vulnerability in the MySQLSelectTool component of Neuron, a PHP framework for building and orchestrating AI Agents. The flaw allows attackers to circumvent the tool's intended read-only SQL enforcement by injecting SELECT ... INTO OUTFILE or SELECT ... INTO DUMPFILE constructs, which are not blocked by the keyword-based validation. It affects all versions of neuron-core/neuron-ai up to and including 2.8.11, and was disclosed on December 10, 2025, with a fix released in version 2.8.12. The vulnerability carries a CVSS v3.1 base score of 8.2 (High) (GitHub Advisory, Feedly).

The root cause is improper input validation (CWE-20) and improper control of code generation (CWE-94) in neuron-ai/src/Tools/Toolkits/MySQL/MySQLSelectTool.php. The tool validates SQL queries by checking that the first keyword is SELECT and comparing against a forbidden-keyword list; however, this list originally omitted INTO, OUTFILE, DUMPFILE, and LOAD_FILE, allowing constructs like SELECT 1 INTO OUTFILE '/var/www/html/shell.php' to pass validation and execute against the database. An attacker who can influence the tool's input — for example, via prompt injection through a public-facing LLM agent endpoint — can craft such queries without any authentication. The attack requires that the MySQL/MariaDB service account holds the FILE privilege and that the server's secure_file_priv setting permits writes to a useful path (GitHub Advisory, Patch Commit).

Successful exploitation can result in arbitrary file writes to the database server's filesystem, which can escalate to remote code execution if files are written to a web-accessible directory (e.g., writing a PHP web shell). There is also a low confidentiality impact, as LOAD_FILE could be used to read sensitive server-side files. The integrity impact is rated High due to the ability to create or overwrite arbitrary files, while availability is not directly affected. Deployments exposing an AI agent using MySQLSelectTool to untrusted user input with overly permissive database credentials are most at risk (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.038%, indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is network-accessible, requires no authentication, and no user interaction, making it straightforward for an attacker who can reach a vulnerable public agent endpoint (GitHub Advisory, Feedly).

1. Reconnaissance: Identify applications using neuron-core/neuron-ai versions ≤ 2.8.11 that expose a public-facing LLM agent endpoint backed by MySQLSelectTool.
2. Probe the agent endpoint: Interact with the agent's chat or query interface to confirm it processes SQL queries via MySQLSelectTool and that responses reflect database output.
3. Craft a prompt injection payload: Submit a natural language prompt or direct query designed to cause the LLM agent to pass a malicious SQL statement to MySQLSelectTool, such as: SELECT '<?php system($_GET["cmd"]); ?>' INTO OUTFILE '/var/www/html/shell.php'.
4. Bypass read-only validation: Because the query begins with SELECT and the forbidden-keyword list did not include INTO/OUTFILE in vulnerable versions, the query passes validation and is executed against the MySQL/MariaDB database.
5. Achieve file write: If the database account has the FILE privilege and secure_file_priv permits writes to the target path, the PHP web shell is written to the web root.
6. Execute arbitrary commands: Access the written web shell via HTTP (e.g., https://target.com/shell.php?cmd=id) to achieve remote code execution on the application host (GitHub Advisory).

• Network: Unexpected HTTP requests to agent endpoints containing SQL-like constructs (INTO OUTFILE, INTO DUMPFILE, LOAD_FILE) in query parameters or request bodies; outbound connections from the web/DB server to unknown external IPs following agent interactions.
• Database Logs: MySQL/MariaDB general query logs showing SELECT ... INTO OUTFILE or SELECT ... INTO DUMPFILE statements executed by the application database account; errors related to secure_file_priv restrictions.
• File System: Newly created or modified PHP files in web-accessible directories (e.g., /var/www/html/) with web shell patterns (system(), exec(), passthru(), $_GET, $_POST); unexpected files with .php extension in directories writable by the MySQL process.
• Application Logs: Unusual or malformed natural language prompts submitted to the agent endpoint that contain SQL keywords (OUTFILE, DUMPFILE, INTO); repeated agent queries that do not match normal user behavior patterns.

Upgrade neuron-core/neuron-ai to version 2.8.12 or later, which adds INTO, OUTFILE, DUMPFILE, and LOAD_FILE to the MySQLSelectTool forbidden-statements list (Release 2.8.12, Patch Commit). If immediate upgrade is not possible, disable or remove MySQLSelectTool from any agent reachable by untrusted input, revoke the FILE privilege from the MySQL/MariaDB service account, and set secure_file_priv to a non-web-accessible directory. Additionally, implement an application-layer query filter that rejects INTO OUTFILE, INTO DUMPFILE, LOAD_FILE, multi-statements (;), and suspicious comment patterns (GitHub Advisory).

The vulnerability was credited to researcher siewer as the finder and was published by the Neuron project maintainer (ilvalerione) via GitHub Security Advisories on December 9, 2025. The advisory recommends moving toward AST-based SQL validation rather than keyword blocklists as a more robust long-term fix. Coverage has been limited to automated vulnerability tracking services such as VulDB, CVEFeed, and INCIBE-CERT, with no significant broader media or researcher commentary observed (GitHub Advisory).