CVE-2024-5350
📋 TL;DR
This critical SQL injection vulnerability in anji-plus AJ-Report allows remote attackers to execute arbitrary SQL commands via the 'p' parameter in the /pageList endpoint. Attackers can potentially access, modify, or delete database content. All users running AJ-Report versions up to 1.4.1 are affected.
💻 Affected Systems
- anji-plus AJ-Report
📦 What is this software?
Aj Report by Anji Plus
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, privilege escalation to system-level access, and potential lateral movement within the network.
Likely Case
Unauthorized data access and extraction from the AJ-Report database, potentially exposing sensitive report data and user information.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing SQL injection, though attack attempts may still appear in logs.
🎯 Exploit Status
Exploit details have been publicly disclosed in GitHub issues and PDF files, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified
Vendor Advisory: https://github.com/anji-plus/report/issues/34
Restart Required: Yes
Instructions:
1. Monitor the GitHub repository for security updates. 2. Apply any available patches for versions above 1.4.1. 3. Restart the AJ-Report service after patching.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns targeting the /pageList endpoint
Network Access Control
allRestrict access to the AJ-Report application to trusted networks only
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries in the application code
- Deploy the application behind a reverse proxy with SQL injection filtering
🔍 How to Verify
Check if Vulnerable:
Check if your AJ-Report version is 1.4.1 or earlier and if the /pageList endpoint is accessibleCheck Version:
Check application configuration files or deployment manifests for version informationVerify Fix Applied:
Verify that the application version is above 1.4.1 and test the /pageList endpoint with SQL injection payloads📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in application logs
- Multiple failed authentication attempts followed by /pageList access
- SQL syntax errors in application responses
Network Indicators:
- Unusual traffic patterns to /pageList endpoint
- SQL keywords in URL parameters (SELECT, UNION, etc.)
SIEM Query:
source="aj-report" AND (url="/pageList" OR url CONTAINS "pageList") AND (param CONTAINS "SELECT" OR param CONTAINS "UNION" OR param CONTAINS "OR 1=1")🔗 References
- https://github.com/anji-plus/report/files/15363269/aj-report.pdf
- https://github.com/anji-plus/report/issues/34
- https://vuldb.com/?ctiid.266262
- https://vuldb.com/?id.266262
- https://github.com/anji-plus/report/files/15363269/aj-report.pdf
- https://github.com/anji-plus/report/issues/34
- https://vuldb.com/?ctiid.266262
- https://vuldb.com/?id.266262
