+++ This bug was initially created as a clone of Bug #13878 +++

I am a vulnerability analyst at VulnCheck responsible for managing our coordinated vulnerability disclosure (CVD) process. A researcher reported this vulnerability affecting IPFire, and VulnCheck is acting as the intermediary and coordinator.

We have tentatively reserved CVE-2025-34210, which have been shared with the researcher but will remain private until public disclosure:

Please be aware that none of this information is public at this moment and all participants are considered under embargo.

VulnCheck follows a 120-day disclosure policy, meaning we allow vendors/maintainers up to 120 days from the time of receiving the report to address the issues before publishing our advisory. For this vulnerability, that 120-day deadline falls on January 21, 2025.

---

When viewing a specific range of OpenVPN connection logs, an HTTP POST request is sent to the Request-URI "/cgi-bin/logs.cgi/ovpnclients.dat". The following SQL query is built and executed:

SELECT common_name, DATETIME(connected_at, 'localtime'),
DATETIME(disconnected_at, 'localtime'), bytes_received, bytes_sent,
STRFTIME('%s', DATETIME(disconnected_at)) - STRFTIME('%s',

DATETIME(connected_at)) AS duration FROM sessions
WHERE
common_name = '<CONNECTION_NAME>'
AND (
DATETIME(disconnected_at, 'localtime') >

DATETIME('$from_datestring', 'start of day')

AND
DATETIME(connected_at, 'localtime') < DATETIME('$to_datestring',

'start of day', '+86399 seconds')

)
ORDER BY connected_at;

where the value of <CONNECTION_NAME> is the value of the HTTP parameter CONNECTION_NAME. This SQL query is built and executed without sanitizing the value of CONNECTION_NAME for SQL-related characters/strings. This can result in SQL injection which can be used for information disclosure. Our testing has found that remote code execution is not possible in default configurations.

The attacker much be authenticated.

---

The attachment contains additional technical details, the affected pathway, and proof of concept.