CVE-2024-48229

Executive Summary

CVE-2024-48229 is a critical SQL injection vulnerability discovered in funadmin version 5.0.2, specifically within the "Curd one click command mode" plugin. This flaw allows an unauthenticated attacker to inject arbitrary SQL commands into the backend database, potentially leading to data exfiltration, modification, or complete system compromise. The vulnerability is publicly known, but no official patch has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains high due to the ease of exploitation and the sensitive nature of the data typically managed by funadmin.

Supply Chain & Package Security

funadmin is a PHP-based admin panel framework. The vulnerability exists in a core plugin, meaning any deployment using the "Curd one click command mode" is affected. Since no patch is available, organizations must rely on manual mitigation or consider replacing the software.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (Unavailable) Vector: UNKNOWN

Despite the missing CVSS vector, the vulnerability is classified as critical due to:

• Attack Vector: Network (unauthenticated)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Impact: High (Confidentiality, Integrity, Availability)

Threat Level: Critical

Deep Dive & Mechanics

The vulnerability resides in the Curd plugin's "one click command mode" functionality. This feature is designed to automate CRUD (Create, Read, Update, Delete) operations based on user input. However, the input is not properly sanitized before being used in SQL queries.

Root Cause: The application directly concatenates user-supplied parameters into SQL statements without parameterization or escaping. An attacker can manipulate the table or field parameters to inject malicious SQL.

Example Attack Vector: An HTTP request to the vulnerable endpoint might look like:

POST /index.php?c=curd&a=oneclick&table=users&field=id

By modifying the table parameter to:

users WHERE 1=1 UNION SELECT username,password FROM admin--

The attacker can retrieve sensitive data from other tables.

Vulnerable vs. Patched Code

Vulnerable Code (funadmin 5.0.2):

// In Curd.php
public function oneclick() {
    $table = $_GET['table'];
    $field = $_GET['field'];
    $sql = "SELECT $field FROM $table";
    $result = $this->db->query($sql);
    // ...
}

Patched Code (Hypothetical):

// In Curd.php
public function oneclick() {
    $table = $this->db->escape($_GET['table']);
    $field = $this->db->escape($_GET['field']);
    // Use prepared statements
    $stmt = $this->db->prepare("SELECT ? FROM ?");
    $stmt->bind_param("ss", $field, $table);
    $stmt->execute();
    // ...
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy funadmin 5.0.2 on a local server (e.g., XAMPP or Docker).
2. Ensure the "Curd one click command mode" plugin is enabled.
3. Use a tool like Burp Suite or SQLMap to test.

Exploitation Steps:

1. Identify the vulnerable endpoint: /index.php?c=curd&a=oneclick
2. Craft a malicious request:

   GET /index.php?c=curd&a=oneclick&table=users WHERE 1=1 UNION SELECT 1,2,3-- -&field=id
   

3. Use SQLMap for automated exploitation:

   sqlmap -u "http://target/index.php?c=curd&a=oneclick&table=users&field=id" --batch --dbs
   

Blue Team

Detection:

• Monitor for unusual SQL error messages in logs.
• Look for requests with suspicious characters in table or field parameters (e.g., UNION, SELECT, --).
• Use WAF rules to block SQL injection patterns.

Mitigation:

• Disable the "Curd one click command mode" plugin if not needed.
• Implement input validation and prepared statements.
• Apply virtual patching via WAF.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing UNION, SELECT, --, or OR 1=1 in the table or field parameters.
  • Unusual database error messages in server logs (e.g., "You have an error in your SQL syntax").
• File IOCs:
  • Modified or new files in the funadmin directory (e.g., webshells).
• System IOCs:
  • Unexpected database queries or data exports.
  • New user accounts or elevated privileges.

Detection Engineering

YARA Rule

rule CVE_2024_48229_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting funadmin Curd plugin"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2024-48229"
    strings:
        $s1 = "table=" nocase
        $s2 = "field=" nocase
        $s3 = "UNION" nocase
        $s4 = "SELECT" nocase
        $s5 = "--" nocase
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5)
}

Sigma Rule

title: SQL Injection Attempt Against funadmin Curd Plugin
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts targeting the Curd one click command mode plugin in funadmin 5.0.2
author: Valters IT
date: 2025-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - '/index.php?c=curd&a=oneclick'
        c-uri|contains|all:
            - 'table='
            - 'field='
        c-uri|contains|any:
            - 'UNION'
            - 'SELECT'
            - '--'
    condition: selection
falsepositives:
    - Legitimate use of UNION in table names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-48229 SQL Injection Attempt Against funadmin Curd Plugin";
    flow:to_server,established;
    content:"/index.php?c=curd&a=oneclick"; http_uri;
    content:"table="; http_uri;
    content:"field="; http_uri;
    pcre:"/(UNION|SELECT|--)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-48229;
)

Remediation & Mitigation

1. Immediate Action: Disable the "Curd one click command mode" plugin in funadmin.
2. Code Fix: Apply input validation and use prepared statements for all database queries.
3. WAF Rules: Deploy virtual patching to block SQL injection patterns.
4. Monitoring: Enable detailed logging and monitor for suspicious activity.
5. Alternative: Consider migrating to a supported admin panel framework.

Valters IT
Securing Digital Frontiers