CVE-2024-25247
📋 TL;DR
This SQL injection vulnerability in Niushop B2B2C V5 allows attackers to execute arbitrary SQL commands through latitude and longitude parameters in the Store.php API controller. Attackers can potentially access, modify, or delete database content. All deployments of Niushop B2B2C V5 with the vulnerable endpoint exposed are affected.
💻 Affected Systems
- Niushop B2B2C
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, authentication bypass, and potential remote code execution via database functions.
Likely Case
Data exfiltration of sensitive information (user credentials, payment data, business records) and potential privilege escalation.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing SQL injection.
🎯 Exploit Status
SQL injection via latitude/longitude parameters suggests straightforward exploitation with common SQLi techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
1. Check Niushop vendor website for security updates. 2. Apply any available patches for Niushop B2B2C V5. 3. Verify the fix by testing the vulnerable endpoint.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement server-side validation to ensure latitude and longitude parameters contain only numeric values within valid ranges.
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection rules to block malicious requests to the vulnerable endpoint.
🧯 If You Can't Patch
- Disable or restrict access to the /app/api/controller/Store.php endpoint using network ACLs or web server configuration.
- Implement parameterized queries or prepared statements in the Store.php controller to prevent SQL injection.
🔍 How to Verify
Check if Vulnerable:
Test the /app/api/controller/Store.php endpoint with SQL injection payloads in latitude and longitude parameters (e.g., ' OR '1'='1).Check Version:
Check Niushop version in admin panel or configuration files (exact command varies by deployment).Verify Fix Applied:
Retest with SQL injection payloads after applying fixes; successful payloads should be rejected or sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Requests to /app/api/controller/Store.php with suspicious parameters containing SQL keywords
Network Indicators:
- HTTP requests with SQL injection patterns in latitude/longitude parameters
SIEM Query:
source="web_logs" AND uri="/app/api/controller/Store.php" AND (param="latitude" OR param="longitude") AND (value="*OR*" OR value="*UNION*" OR value="*SELECT*" OR value="*--*" OR value="*;*")