CVE-2024-2592
📋 TL;DR
This SQL injection vulnerability in AMSS++ version 4.31 allows remote attackers to execute arbitrary SQL queries through the 'person_id' parameter in pic_show.php. This could lead to complete database compromise, exposing sensitive information. Organizations using AMSS++ version 4.31 are affected.
💻 Affected Systems
- AMSS++
📦 What is this software?
Amss\+\+ by Amss\+\+ Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including exfiltration of all stored data, potential authentication bypass, and possible remote code execution if database permissions allow.
Likely Case
Data exfiltration of sensitive information from the database, including personal data, credentials, and system information.
If Mitigated
Limited impact with proper input validation and database permission restrictions in place.
🎯 Exploit Status
SQL injection through HTTP parameter requires minimal technical skill to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss
Restart Required: No
Instructions:
1. Check vendor website for updated version. 2. Apply patch if available. 3. Implement input validation and parameterized queries.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns in the person_id parameter
Input Validation Filter
allAdd server-side validation to restrict person_id parameter to numeric values only
// PHP example: if(!is_numeric($_GET['person_id'])) { die('Invalid input'); }
🧯 If You Can't Patch
- Implement network segmentation to restrict access to AMSS++ server
- Deploy web application firewall with SQL injection detection rules
🔍 How to Verify
Check if Vulnerable:
Test the pic_show.php endpoint with SQL injection payloads in the person_id parameterCheck Version:
Check AMSS++ version in admin panel or configuration filesVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and return appropriate error messages📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in web server logs
- Multiple requests to pic_show.php with suspicious person_id values
Network Indicators:
- HTTP requests containing SQL keywords in person_id parameter
- Unusual database query patterns from web server
SIEM Query:
source="web_logs" AND uri="/amssplus/modules/person/pic_show.php" AND (query="*UNION*" OR query="*SELECT*" OR query="*OR*1=1*")