CVE-2024-46103

Executive Summary

CVE-2024-46103 identifies a critical SQL Injection vulnerability in SEMCMS 4.8, specifically within the SEMCMS_Main.php file. This flaw allows an unauthenticated attacker to inject arbitrary SQL commands, potentially leading to unauthorized data access, data exfiltration, or complete database compromise. The vulnerability is publicly known, but no official patch or advisory has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains high due to the lack of a patch.

Supply Chain & Package Security

This vulnerability does not affect NPM, PyPI, Go, or Ruby packages. It is a standalone PHP application vulnerability.

CVSS Breakdown & Threat Level

While a CVSS vector is not provided, based on the nature of the vulnerability (SQL Injection in a web application), a typical assessment would be:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the database.
• Confidentiality (C): High (H) – Full database read access.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Database can be disrupted.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability is trivial to exploit and can lead to complete database compromise.

Deep Dive & Mechanics

The vulnerability resides in SEMCMS_Main.php. The application fails to properly sanitize user-supplied input before using it in SQL queries. An attacker can inject malicious SQL code through HTTP parameters (likely GET or POST) that are passed to the database without proper escaping or parameterization.

Root Cause: The application uses string concatenation to build SQL queries, directly embedding user input without using prepared statements or input validation.

Exploitation Mechanics:

1. The attacker identifies a parameter in SEMCMS_Main.php that is passed to a SQL query.
2. The attacker injects a SQL payload, such as ' OR '1'='1 or a UNION-based injection to extract data.
3. The injected SQL is executed by the database, returning unauthorized data or allowing further manipulation.

Example vulnerable code pattern (conceptual):

$id = $_GET['id'];
$query = "SELECT * FROM users WHERE id = '$id'";
$result = mysqli_query($conn, $query);

Vulnerable vs. Patched Code

Vulnerable Code (SEMCMS 4.8):

// SEMCMS_Main.php (vulnerable)
$id = $_GET['id'];
$sql = "SELECT * FROM articles WHERE id = '$id'";
$result = mysqli_query($conn, $sql);

Patched Code (Hypothetical):

// SEMCMS_Main.php (patched)
$id = $_GET['id'];
$stmt = $conn->prepare("SELECT * FROM articles WHERE id = ?");
$stmt->bind_param("i", $id);
$stmt->execute();
$result = $stmt->get_result();

Key Differences:

• The patched version uses prepared statements with parameterized queries, preventing SQL injection.
• The vulnerable version directly concatenates user input into the SQL string.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy SEMCMS 4.8 on a local server (e.g., XAMPP, LAMP).
2. Ensure the application is accessible via a web browser.
3. Use a tool like Burp Suite or a simple Python script to send crafted requests.

Exploitation Steps:

1. Identify the vulnerable parameter. For example, id in SEMCMS_Main.php.
2. Send a request with a SQL injection payload:

   GET /SEMCMS_Main.php?id=1' UNION SELECT 1,2,3,4,5,6,7,8,9,10--+
   

3. Observe the response for injected data.
4. Use sqlmap for automated exploitation:

   sqlmap -u "http://target.com/SEMCMS_Main.php?id=1" --batch --dbs
   

Example Payload:

' OR '1'='1' -- 

Blue Team (Defensive)

Detection Steps:

1. Monitor web server logs for suspicious SQL keywords (e.g., UNION, SELECT, OR 1=1).
2. Implement a Web Application Firewall (WAF) with rules to block SQL injection patterns.
3. Use database activity monitoring to detect anomalous queries.

Mitigation Steps:

1. Immediately apply input validation and parameterized queries.
2. Restrict database user permissions to the minimum required.
3. Enable detailed logging for all database queries.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing SQL keywords in parameters (e.g., id=1' UNION SELECT).
  • Unusual database error messages in HTTP responses.
• File IOCs:
  • Modified SEMCMS_Main.php file (if attacker uploads a webshell).
  • New files in the web root (e.g., shell.php).
• Database IOCs:
  • Unexpected queries in database logs.
  • New user accounts or modified data.

Detection Engineering

YARA Rule

rule CVE_2024_46103_SQLi_SEMCMS {
    meta:
        description = "Detects SQL injection attempts targeting SEMCMS 4.8"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-46103"
    strings:
        $s1 = "SEMCMS_Main.php" nocase
        $s2 = "id=" nocase
        $s3 = "UNION" nocase
        $s4 = "SELECT" nocase
        $s5 = "OR 1=1" nocase
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5)
}

Sigma Rule

title: SQL Injection Attempt Against SEMCMS 4.8
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts targeting SEMCMS_Main.php
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - 'SEMCMS_Main.php'
            - 'id='
        cs-uri-query|contains|all:
            - 'UNION'
            - 'SELECT'
    condition: selection
falsepositives:
    - Legitimate use of UNION SELECT in rare cases
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-46103 SQL Injection Attempt"; flow:to_server,established; content:"SEMCMS_Main.php"; http_uri; content:"id="; http_uri; pcre:"/(UNION|SELECT|OR\s+1=1)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected server from the network if possible.
2. Disable the vulnerable functionality or the entire application until a patch is applied.
3. Implement a WAF with custom rules to block SQL injection patterns.

Long-Term Fixes:

1. Rewrite the vulnerable code to use prepared statements or parameterized queries.
2. Conduct a full security audit of the application.
3. Apply the principle of least privilege to the database user.
4. Monitor for any signs of compromise.

Workaround:

• If patching is not possible, use a reverse proxy with SQL injection filtering (e.g., ModSecurity).

Valters IT
Securing Digital Frontiers