CVE-2024-13194
📋 TL;DR
This CVE describes a critical SQL injection vulnerability in Sucms 1.0's admin_members.php file. Attackers can manipulate the 'uid' parameter to execute arbitrary SQL commands remotely. All Sucms 1.0 installations with the vulnerable admin interface exposed are affected.
💻 Affected Systems
- Sucms
📦 What is this software?
Sucms by Sucms Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, privilege escalation to admin, and potential remote code execution via database functions.
Likely Case
Unauthorized data access, extraction of sensitive user/admin credentials, and potential site defacement or data corruption.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only read-only access to non-sensitive data.
🎯 Exploit Status
Exploit requires access to the admin interface. The vulnerability is in a GET parameter, making exploitation straightforward with available tools like sqlmap.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Consider migrating to supported software or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd parameter validation to ensure 'uid' parameter only accepts expected values (integers).
Modify /admin/admin_members.php to add: if (!is_numeric($_GET['uid'])) { die('Invalid input'); }
Web Application Firewall (WAF) Rules
allBlock SQL injection patterns targeting the uid parameter in admin_members.php.
Add WAF rule: Block requests to /admin/admin_members.php?ac=search with SQL injection patterns in uid parameter
🧯 If You Can't Patch
- Restrict access to /admin/ directory to trusted IP addresses only using .htaccess or firewall rules.
- Disable or remove the vulnerable admin_members.php file if functionality is not required.
🔍 How to Verify
Check if Vulnerable:
Test the endpoint with SQL injection payloads: /admin/admin_members.php?ac=search&uid=1' OR '1'='1Check Version:
Check Sucms version in configuration files or admin panel; typically in config.php or similar.Verify Fix Applied:
Attempt SQL injection tests after implementing fixes; verify no database errors or unexpected behavior occurs.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in web server logs for admin_members.php
- Multiple failed login attempts followed by SQL injection attempts
- Requests with SQL keywords in uid parameter
Network Indicators:
- Unusual database queries originating from web server
- Traffic patterns showing SQL injection tools like sqlmap
SIEM Query:
source="web_logs" AND uri="/admin/admin_members.php" AND (query="*uid=*'*" OR query="*uid=*%27*")