CVE-2024-39037
📋 TL;DR
MyNET versions up to v26.08.316 contain an unauthenticated SQL injection vulnerability in the intmenu parameter. This allows attackers to execute arbitrary SQL commands without authentication, potentially compromising the database. All users running vulnerable MyNET versions are affected.
💻 Affected Systems
- MyNET
📦 What is this software?
Mynet by Airc
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, or deletion; potential remote code execution if database configuration permits.
Likely Case
Data exfiltration from the database, authentication bypass, or privilege escalation within the application.
If Mitigated
Limited impact with proper input validation and database permissions, though SQL injection attempts may still cause performance issues.
🎯 Exploit Status
Exploit code is publicly available; exploitation requires minimal technical skill due to unauthenticated access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v26.08.317 or later
Vendor Advisory: https://www.airc.pt/solucoes-servicos/solucoes?segment=MYN
Restart Required: Yes
Instructions:
1. Download the latest MyNET version from the vendor. 2. Backup current configuration and data. 3. Install the updated version. 4. Restart the MyNET service.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy a WAF to block SQL injection attempts targeting the intmenu parameter.
Input Validation Filter
allImplement server-side input validation to sanitize the intmenu parameter.
🧯 If You Can't Patch
- Isolate the MyNET system from untrusted networks using firewall rules.
- Implement strict database permissions to limit potential damage from SQL injection.
🔍 How to Verify
Check if Vulnerable:
Check if the MyNET version is v26.08.316 or earlier; test the intmenu parameter with SQL injection payloads.Check Version:
Check the MyNET administration interface or configuration files for version information.Verify Fix Applied:
Verify the MyNET version is v26.08.317 or later; retest the intmenu parameter with SQL injection payloads to confirm they are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts or parameter manipulation in application logs
Network Indicators:
- HTTP requests containing SQL keywords (e.g., SELECT, UNION) in the intmenu parameter
SIEM Query:
source="web_logs" AND (url="*intmenu=*SELECT*" OR url="*intmenu=*UNION*")