CVE-2024-25400
📋 TL;DR
This disputed CVE claims Subrion CMS 4.2.1 has SQL injection vulnerability in ia.core.mysqli.php, potentially allowing attackers to execute arbitrary SQL commands. However, third parties dispute the vulnerability exists since the file reportedly lacks external input mechanisms. Organizations using Subrion CMS 4.2.1 should verify their exposure.
💻 Affected Systems
- Subrion CMS
📦 What is this software?
Subrion by Intelliants
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation, or system takeover if vulnerability exists and is exploited
Likely Case
Limited impact given disputed nature and lack of proven exploitation vectors
If Mitigated
No impact if proper input validation and parameterized queries are already implemented
🎯 Exploit Status
No confirmed exploitation due to disputed nature; requires specific conditions if vulnerability exists
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not applicable
Vendor Advisory: https://github.com/intelliants/subrion/issues/910
Restart Required: No
Instructions:
1. Review the disputed GitHub issue
2. Verify if your installation uses the reported file
3. Consider upgrading to latest Subrion version if concerned
🔧 Temporary Workarounds
Input Validation Enhancement
allImplement strict input validation and parameterized queries for all database operations
File Access Restriction
linuxRestrict direct access to PHP class files via web server configuration
# Apache: Add to .htaccess
<Files "ia.core.mysqli.php">
Order Allow,Deny
Deny from all
</Files>
# Nginx: Add to server block
location ~* /ia\.core\.mysqli\.php$ {
deny all;
}
🧯 If You Can't Patch
- Implement web application firewall with SQL injection rules
- Restrict database user permissions to minimum required
🔍 How to Verify
Check if Vulnerable:
Check if Subrion CMS version is 4.2.1 and review the ia.core.mysqli.php file for SQL injection vulnerabilitiesCheck Version:
Check Subrion CMS admin panel or review includes/constants.php for version informationVerify Fix Applied:
Verify file modifications or upgrade to newer version📡 Detection & Monitoring
Log Indicators:
- Unusual database queries
- Access attempts to ia.core.mysqli.php
- SQL error messages in logs
Network Indicators:
- Unusual POST/GET parameters with SQL syntax
- Requests to PHP class files
SIEM Query:
source="web_logs" AND (uri="*ia.core.mysqli.php*" OR message="*SQL*" OR message="*database*error*")