CVE-2025-45809

MEDIUM
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-45809 has a selected CVSS score of 5.4 (medium); EIP currently links 1 repository PoC and 1 lab environment.

Description

SQL Injection vulnerability in BerriAI LiteLLM before 1.81.0 allows attackers to execute arbitrary commands via the key parameter to the "/key/block" and "/key/unblock" API endpoints.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 3, 2025 · Source: CVE List

Proofs of concept

1

Repository PoCs

GitHublearner202649/CVE-2025-45809-PoCRepository PoCby learner2026490Exploit10 files

28.9 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python exploit for CVE-2025-45809, a time-based blind SQL injection in LiteLLM's /key/block and /key/unblock endpoints. It sends crafted payloads to trigger pg_sleep() delays, confirms the vulnerability, and extracts database data and files character-by-character.

Backdoor review

No backdoor observed in reviewed code

The repository contains a proof-of-concept exploit for CVE-2025-45809, a SQL injection vulnerability in LiteLLM. The exploit script sends time-based blind SQL injection payloads to a target server to confirm the vulnerability and extract data. All observed behavior is consistent with a legitimate PoC: it sends crafted HTTP requests to demonstrate the vulnerability, measures response times, and extracts data character-by-character. No concealed executable behavior, persistence, credential theft, or unrelated payloads were found.

ClassificationExploit
Model confidence100%
AuthenticationRequired
LanguagesPython
Target softwareLiteLLM
Attack typesSQL InjectionTime-based Blind SQL Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains executable Python code (exploit/exploit.py) that actively sends SQL injection payloads to a target server to trigger time delays, extract database contents, and read server files. This is the definition of an exploit.

exploit/exploit.py:1-386exploit/payload.py:1-102

Requirements

  • Requires a valid LiteLLM API key (defaults to master key 'sk-litellm-master-key') for authentication.exploit/exploit.py:47-70
  • Requires the LiteLLM Key database table to be initialized by first calling /key/generate.exploit/exploit.py:73-103

Observed behavior

  • Sends a baseline request to measure normal response time.exploit/exploit.py:149-155
  • Sends a payload with a SQL comment (' OR 1=1 --) to test basic injection.exploit/exploit.py:158-161
  • Sends payloads containing pg_sleep(3) and pg_sleep(5) to confirm time-based SQL injection by measuring response delays.exploit/exploit.py:164-175
  • Extracts database data (e.g., current_user, version()) character-by-character using conditional pg_sleep() delays.exploit/exploit.py:202-261
  • Reads server files (e.g., /etc/passwd) character-by-character using pg_read_file() and conditional pg_sleep() delays.exploit/exploit.py:280-313
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Behavior
Payload withheldThis is the core exploit behavior demonstrating the CVE; it targets the vulnerable application, not the operator.exploit/exploit.py:106-136exploit/payload.py:14-27
Network Behavior
Payload withheldThis is a documented prerequisite for the exploit to work; it creates a legitimate API key to ensure the vulnerable code path is reachable.exploit/exploit.py:73-103README.md:57-61
Data Extraction
Payload withheldThis demonstrates the impact of the vulnerability as described in the CVE; it extracts data from the target server, not from the operator.exploit/exploit.py:264-277exploit/exploit.py:280-313
Review boundaries

What the analysis did not establish

  • Evidence coverage is COMPLETE_FOR_READABLE_SELECTED_TEXT; 6 files (including Dockerfiles, config, and docs) are omitted from the packet content but their metadata is present. The exploit code itself is fully included.
  • Six files (including Dockerfiles, YAML configs, and documentation) were omitted from the text evidence due to size constraints; their metadata was provided but content was not reviewed.
  • Binary files were flagged as metadata-only and not analyzed; none were reported in the inventory.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

docker-compose.yml

learner202649/CVE-2025-45809-PoCCreated Vuln labCVE-2025-45809Compose · mixed

1 Compose manifest · 1 Dockerfile · 3 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment for demonstrating CVE-2025-45809, a time-based blind SQL injection vulnerability in LiteLLM versions before 1.81.0. It includes a PostgreSQL database, a vulnerable LiteLLM v1.65.4 service built from a local Dockerfile, and an optional fixed LiteLLM v1.83.10 service. Exploit scripts are provided to confirm the injection and extract data.

docker-compose.yml:1-50README.md:1-242

Lab assessment

Vulnerability lab

The README explicitly states the environment is a proof-of-concept for CVE-2025-45809, a SQL injection vulnerability in LiteLLM. The Compose file defines a vulnerable service (litellm-vuln) with the affected version, a database, and a fixed service for comparison. Exploit scripts are included to exercise the vulnerability.

README.md:1-3docker-compose.yml:18-31
Lab shapeCompose · mixed
Services3
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

db

PostgreSQL database for LiteLLM

A PostgreSQL 15 Alpine container that stores LiteLLM data. It is configured with a healthcheck and exposes port 5432.

docker-compose.yml:3-15

litellm-vuln

Vulnerable LiteLLM target

A LiteLLM v1.65.4 service built from a local Dockerfile. It is the vulnerable target for the SQL injection exploit. It mounts a config file and connects to the db service.

docker-compose.yml:18-31litellm-vuln/Dockerfile:1-16

litellm-fixed

Fixed LiteLLM comparison service

A LiteLLM v1.83.10-stable service used to demonstrate that the vulnerability is fixed. It is only started when the 'fixed' profile is enabled.

docker-compose.yml:34-50

exploit/exploit.py

SQL injection exploit script

A Python script that performs time-based blind SQL injection against the /key/block endpoint. It can confirm the vulnerability, extract database users, versions, and read files.

exploit/exploit.py:1-386

exploit/payload.py

SQL injection payload builder

A Python module that constructs SQL injection payloads for pg_sleep delays, data exfiltration, and file reading.

exploit/payload.py:1-102
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-45809

Supported by supplied evidence

The environment is explicitly designed to demonstrate CVE-2025-45809. The vulnerable service uses LiteLLM v1.65.4, which is within the affected range (<1.81.0). The exploit scripts target the /key/block endpoint with time-based SQL injection payloads, matching the CVE description.

README.md:1-3litellm-vuln/Dockerfile:7exploit/exploit.py:1-6
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to start the environment.README.md:55-57
  • Python dependencies (requests) must be installed to run the exploit.README.md:59-60requirements.txt:1
  • The vulnerable LiteLLM service must be running and the database initialized (exploit script handles initialization automatically).README.md:63-68exploit/exploit.py:72-100

Evidence-described exercise path

  1. Start the vulnerable environment with 'docker compose up -d'.README.md:55-57
  2. Install Python dependencies with 'pip install -r requirements.txt'.README.md:59-60
  3. Confirm the SQL injection by running 'python3 exploit/exploit.py --mode check --target http://localhost:4000'.README.md:62-63
  4. Extract the database user with 'python3 exploit/exploit.py --mode extract-user --target http://localhost:4000'.README.md:71-72
  5. Extract the PostgreSQL version with 'python3 exploit/exploit.py --mode extract-version --target http://localhost:4000'.README.md:74-75
  6. Attempt to read /etc/passwd with 'python3 exploit/exploit.py --mode file-read --target http://localhost:4000'.README.md:77-78
  7. Optionally verify the fix by starting the fixed service and running the check against it.README.md:80-82
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own vulnerable target. The exploit scripts send SQL injection payloads to the local LiteLLM service to demonstrate the vulnerability. There is no evidence of host escape, external connections, persistence, credential theft, or destructive actions beyond the intended lab exercise.

exploit/exploit.py:1-386exploit/payload.py:1-102docker-compose.yml:1-50
Review boundaries

What the analysis did not establish

  • The packet does not include the actual execution output or runtime behavior; analysis is based solely on static configuration and script content.
  • The exploit scripts are not executed, so their exact runtime effects (e.g., whether file read succeeds) are not confirmed.
  • The fixed service image (ghcr.io/berriai/litellm:v1.83.10-stable) is not inspected; its behavior is assumed from the README.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

3