CVE-2024-45174

Executive Summary

CVE-2024-45174 is a critical SQL injection vulnerability discovered in za-internet C-MOR Video Surveillance software, specifically versions 5.2401 and 6.00PL01. The flaw resides in multiple web interface functionalities that fail to properly validate user-supplied input, allowing an authenticated attacker to execute arbitrary SQL commands against the underlying MySQL database. This can lead to unauthorized data access, modification, or deletion, and potentially full compromise of the surveillance system. No public proof-of-concept (PoC) or patch is currently available, making this a high-risk vulnerability for unpatched deployments.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD base score not assigned; estimated high based on impact)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires authenticated user
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)
• Threat Level: Critical – authenticated SQL injection can lead to full database compromise and lateral movement within the surveillance network.

Deep Dive & Mechanics

The vulnerability exists in the C-MOR web interface, which is used for managing video surveillance systems. The application fails to sanitize user-supplied parameters before incorporating them into SQL queries. An authenticated attacker can inject malicious SQL statements through input fields such as search boxes, filters, or configuration parameters. The MySQL database backend stores sensitive data including user credentials, camera configurations, and recorded video metadata. Successful exploitation allows the attacker to extract, modify, or delete this data, and potentially execute operating system commands via MySQL’s INTO OUTFILE or LOAD_FILE functions if file permissions allow.

The attack flow:

1. Attacker authenticates to the C-MOR web interface.
2. Attacker identifies an input parameter that is passed unsanitized to a SQL query.
3. Attacker injects a SQL payload (e.g., ' OR '1'='1 or UNION SELECT ...).
4. The database executes the malicious query, returning or modifying data as intended.

Vulnerable vs. Patched Code

Vulnerable Code (example):

$id = $_GET['camera_id'];
$query = "SELECT * FROM cameras WHERE id = '$id'";
$result = mysqli_query($conn, $query);

Patched Code (recommended):

$id = intval($_GET['camera_id']);
$query = "SELECT * FROM cameras WHERE id = ?";
$stmt = mysqli_prepare($conn, $query);
mysqli_stmt_bind_param($stmt, "i", $id);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);

The patched version uses parameterized queries (prepared statements) to ensure user input is treated as data, not executable code.

Exploitation & Lab Setup

Red Team

Lab Setup:

• Install C-MOR Video Surveillance 5.2401 or 6.00PL01 on a virtual machine.
• Configure a MySQL database with sample data.
• Access the web interface with valid credentials.

Exploitation Steps:

1. Identify a vulnerable parameter (e.g., camera_id in a GET request).
2. Inject a SQL payload to extract data:

   ' UNION SELECT username, password FROM users --
   

3. Use a tool like sqlmap for automated exploitation:

   sqlmap -u "http://target/camera.php?id=1" --cookie="session=valid" --batch --dump
   

Example Payload:

1' AND 1=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10 FROM information_schema.tables --

Blue Team

Detection:

• Monitor web server logs for SQL injection patterns (e.g., ' OR, UNION SELECT, --).
• Use WAF rules to block suspicious SQL keywords.
• Implement database activity monitoring for anomalous queries.

Hunting:

• Search for requests with multiple SQL keywords in a single parameter.
• Look for error messages containing SQL syntax errors in application logs.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing SQL injection patterns (e.g., ' OR, UNION, --).
  • Unusual database error messages in HTTP responses.
• File IOCs:
  • Unexpected files in the web root (e.g., cmd.php, shell.php).
  • Modified application configuration files.
• Database IOCs:
  • New or modified user accounts in the users table.
  • Unusual queries in MySQL general log (if enabled).

Detection Engineering

YARA Rule

rule CVE_2024_45174_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting C-MOR Video Surveillance"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-45174"
    strings:
        $sqli1 = /'.*OR.*1=1/i
        $sqli2 = /'.*UNION.*SELECT/i
        $sqli3 = /'.*--/i
        $sqli4 = /'.*DROP/i
        $sqli5 = /'.*INSERT/i
    condition:
        any of ($sqli*) and filesize < 10KB
}

Sigma Rule

title: C-MOR Video Surveillance SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection patterns in HTTP requests to C-MOR web interface
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - "' OR"
            - "' UNION"
            - "'--"
            - "1=1"
            - "DROP TABLE"
    condition: selection
falsepositives:
    - Legitimate use of special characters in search queries
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-45174 C-MOR SQL Injection Attempt"; flow:to_server,established; content:"GET"; http_method; content:"camera.php"; http_uri; pcre:"/(\x27OR|\x27UNION|\x27--|1=1|DROP TABLE)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the C-MOR web interface if not required.
   • Restrict network access to the web interface via firewall rules.
   • Implement a Web Application Firewall (WAF) with SQL injection rules.

2. Long-term Fix:

   • Apply parameterized queries (prepared statements) to all database interactions.
   • Conduct a full code audit for similar vulnerabilities.
   • Monitor vendor for official patch release.

3. Compensating Controls:

   • Use database user with least privileges (no FILE or DROP permissions).
   • Enable MySQL general log for auditing (with caution for performance).
   • Implement input validation and output encoding.

Valters IT