CVE-2024-10129
📋 TL;DR
This critical SQL injection vulnerability in HFO4 shudong-share allows remote attackers to execute arbitrary SQL commands via the 'fkey' parameter in /includes/create_share.php. Attackers can potentially read, modify, or delete database content. All users of shudong-share up to version 2.4.7 are affected.
💻 Affected Systems
- HFO4 shudong-share
📦 What is this software?
Shudong Share by Shudong Share Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, and potential remote code execution if database permissions allow file operations.
Likely Case
Unauthorized data access, data manipulation, and potential privilege escalation through database queries.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database user privilege restrictions.
🎯 Exploit Status
Public exploit code available on GitHub. Remote exploitation possible without authentication. Simple SQL injection technique.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor was contacted but did not respond. Consider migrating to alternative software or implementing workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize the fkey parameter before processing
Modify /includes/create_share.php to add: $fkey = mysqli_real_escape_string($connection, $_POST['fkey']);
Parameterized Query Implementation
allReplace vulnerable SQL queries with prepared statements
Replace raw SQL queries with: $stmt = $connection->prepare('SELECT * FROM table WHERE fkey = ?'); $stmt->bind_param('s', $fkey);
🧯 If You Can't Patch
- Implement WAF rules to block SQL injection patterns targeting the fkey parameter
- Restrict network access to the application using firewall rules
🔍 How to Verify
Check if Vulnerable:
Check if /includes/create_share.php exists and contains unsanitized fkey parameter usage in SQL queriesCheck Version:
Check version in application files or documentationVerify Fix Applied:
Test the fkey parameter with SQL injection payloads to confirm they are properly sanitized or blocked📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple failed login attempts or unusual database queries
Network Indicators:
- HTTP requests to /includes/create_share.php with SQL injection patterns in fkey parameter
SIEM Query:
source="web_logs" AND uri="/includes/create_share.php" AND (fkey CONTAINS "' OR" OR fkey CONTAINS "--" OR fkey CONTAINS "UNION")