CVE-2024-41370

Executive Summary

CVE-2024-41370 is a SQL injection vulnerability discovered in Organizr v1.90, specifically within the chat/setlike.php endpoint. This flaw allows an unauthenticated attacker to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but based on the nature of SQL injection, the actual severity is high. No official patch or exploit code has been published at this time, but the vulnerability is publicly known.

Supply Chain & Package Security

Organizr is a self-hosted PHP application. The vulnerability exists in the core application code, not in a third-party package. However, users should verify the integrity of their Organizr installation and ensure no malicious modifications have been made.

CVSS Breakdown & Threat Level

While the official CVSS score is 0.0, a realistic assessment based on the vulnerability type is:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full database read access is possible.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Database can be disrupted.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Estimated Score: 9.8 (Critical)

Deep Dive & Mechanics

The vulnerability resides in chat/setlike.php. This endpoint likely handles "likes" on chat messages. The application fails to properly sanitize user-supplied input before incorporating it into a SQL query. An attacker can manipulate parameters (e.g., message_id, user_id) to inject SQL commands.

Example vulnerable code snippet (conceptual):

$message_id = $_GET['message_id'];
$query = "UPDATE messages SET likes = likes + 1 WHERE id = $message_id";
mysqli_query($conn, $query);

Without parameterized queries or input validation, an attacker can supply message_id=1 OR 1=1 to update all rows, or use UNION-based injection to extract data.

Vulnerable vs. Patched Code

Vulnerable Code (Organizr v1.90):

// chat/setlike.php
$message_id = $_GET['message_id'];
$query = "UPDATE messages SET likes = likes + 1 WHERE id = $message_id";
$result = mysqli_query($conn, $query);

Patched Code (Hypothetical):

// chat/setlike.php
$message_id = intval($_GET['message_id']);
$query = "UPDATE messages SET likes = likes + 1 WHERE id = ?";
$stmt = mysqli_prepare($conn, $query);
mysqli_stmt_bind_param($stmt, "i", $message_id);
mysqli_stmt_execute($stmt);

The patched version uses type casting (intval) and prepared statements to prevent SQL injection.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy Organizr v1.90 on a local server (e.g., using Docker or XAMPP).
2. Ensure the chat feature is enabled and accessible.

Exploitation Steps:

1. Identify the vulnerable endpoint: http://target/organizr/chat/setlike.php?message_id=1
2. Test for SQL injection by appending a single quote: message_id=1' – observe error.
3. Use UNION-based injection to extract data:

   http://target/organizr/chat/setlike.php?message_id=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100--
   

4. Enumerate database tables and columns using information_schema.

Example SQLMap command:

sqlmap -u "http://target/organizr/chat/setlike.php?message_id=1" --batch --dbs

Blue Team (Defensive)

Detection:

• Monitor for unusual SQL error messages in logs.
• Look for requests to setlike.php with abnormal parameters (e.g., containing SQL keywords like UNION, SELECT, OR).
• Use WAF rules to block SQL injection patterns.

Mitigation:

• Immediately upgrade to a patched version if available.
• Implement input validation and parameterized queries.
• Restrict database user permissions to least privilege.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /chat/setlike.php with parameters containing SQL syntax (e.g., ', OR, UNION).
• Logs: SQL error messages in application logs, such as "You have an error in your SQL syntax".
• Database: Unexpected rows in messages table (e.g., all likes incremented simultaneously).
• File: Modified setlike.php file (check file integrity).

Detection Engineering

YARA Rule

rule CVE_2024_41370_Organizr_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting Organizr v1.90 setlike.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-41370"
    strings:
        $s1 = "setlike.php" nocase
        $s2 = "message_id=" nocase
        $sqli1 = /message_id=[^&]*['"]/ nocase
        $sqli2 = /message_id=[^&]*(OR|UNION|SELECT|DROP|INSERT|UPDATE|DELETE)/i
    condition:
        $s1 and $s2 and ($sqli1 or $sqli2)
}

Sigma Rule

title: SQL Injection Attempt on Organizr setlike.php
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts targeting Organizr v1.90 chat/setlike.php
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-41370
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 
            - "setlike.php"
            - "message_id="
        cs-uri-query|re: 
            - "message_id=[^&]*['\"]"
            - "message_id=[^&]*(OR|UNION|SELECT|DROP|INSERT|UPDATE|DELETE)"
    condition: selection
falsepositives:
    - Legitimate use of special characters in message IDs (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-41370 SQL Injection Attempt on Organizr setlike.php"; flow:to_server,established; content:"setlike.php"; http_uri; content:"message_id="; http_uri; pcre:"/message_id=[^&]*['\"]/Ui"; pcre:"/message_id=[^&]*(OR|UNION|SELECT|DROP|INSERT|UPDATE|DELETE)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the chat feature or restrict access to setlike.php via .htaccess or firewall rules.
2. Code Fix: Replace all direct SQL queries with prepared statements and parameterized queries. Validate and sanitize all user inputs.
3. Database Hardening: Ensure the database user used by Organizr has minimal privileges (e.g., only SELECT, INSERT, UPDATE on necessary tables).
4. Monitoring: Implement logging and alerting for SQL injection attempts.
5. Update: Monitor the Organizr GitHub repository for official patches and apply them promptly.

Valters IT