CVE-2024-5958
📋 TL;DR
This SQL injection vulnerability in Eliz Software Panel allows attackers to execute arbitrary SQL commands, potentially leading to command line execution on the underlying system. It affects all installations running Panel versions before v2.3.24. Attackers could gain unauthorized access, manipulate data, or compromise the entire system.
💻 Affected Systems
- Eliz Software Panel
📦 What is this software?
Panel by Elizsoftware
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with remote code execution, data exfiltration, and complete control over the affected server.
Likely Case
Database manipulation, data theft, privilege escalation, and potential command execution depending on database configuration.
If Mitigated
Limited to database information disclosure if proper input validation and parameterized queries are implemented.
🎯 Exploit Status
SQL injection vulnerabilities are typically easy to exploit with automated tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v2.3.24
Vendor Advisory: https://www.usom.gov.tr/bildirim/tr-24-1497
Restart Required: Yes
Instructions:
1. Backup your current installation and database. 2. Download v2.3.24 from official Eliz Software sources. 3. Replace existing files with patched version. 4. Restart the Panel service. 5. Verify functionality.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection protection rules to block exploitation attempts.
Input Validation Filter
allImplement custom input validation to sanitize SQL special characters before processing.
🧯 If You Can't Patch
- Isolate the vulnerable system from internet access and restrict to internal network only.
- Implement strict network segmentation and monitor all database queries for suspicious patterns.
🔍 How to Verify
Check if Vulnerable:
Check Panel version in admin interface or configuration files. If version is below 2.3.24, system is vulnerable.Check Version:
Check Panel admin dashboard or configuration files for version information.Verify Fix Applied:
Confirm version shows 2.3.24 or higher in admin panel and test SQL injection attempts are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL query patterns
- Multiple failed login attempts with SQL syntax
- Database error messages containing SQL fragments
Network Indicators:
- HTTP requests containing SQL keywords (SELECT, UNION, DROP, etc.)
- Unusual database port traffic patterns
SIEM Query:
source="web_logs" AND ("SELECT" OR "UNION" OR "DROP" OR "INSERT" OR "UPDATE") AND status=200