CVE-2024-0481: Jifeer Taokeyun SQL Injection Vulnerability

CVE-2024-0481 Overview

CVE-2024-0481 is a SQL injection vulnerability affecting Jifeer Taokeyun versions up to 1.0.5. The flaw resides in the shopGoods function within application/index/controller/app/store/Goods.php. Attackers can manipulate the keyword parameter in HTTP POST requests to inject arbitrary SQL statements. The vulnerability requires no authentication and can be exploited remotely over the network. Public disclosure of exploitation details increases the risk of opportunistic attacks against exposed Taokeyun deployments. The flaw is tracked under VulDB identifier VDB-250586 and maps to [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated remote attackers can extract, modify, or destroy database contents through a single crafted HTTP POST request to the vulnerable shopGoods endpoint.

Affected Products

Jifeer Taokeyun versions up to and including 1.0.5
The shopGoods function in application/index/controller/app/store/Goods.php
Deployments exposing the HTTP POST request handler to untrusted networks

Discovery Timeline

2024-01-13 - CVE-2024-0481 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-0481

Vulnerability Analysis

The vulnerability stems from unsafe handling of user-supplied input in the shopGoods controller method. The application accepts the keyword parameter from HTTP POST requests and incorporates it directly into a SQL query without parameterization or sufficient sanitization. An attacker controls the structure of the resulting SQL statement.

This enables classic in-band SQL injection techniques, including UNION-based data extraction, boolean-based blind injection, and time-based blind injection. Successful exploitation exposes the entire database schema, including credentials, order data, and customer records stored by the Taokeyun e-commerce platform.

Given that Taokeyun is built on PHP and typically runs against MySQL, attackers can also leverage INTO OUTFILE clauses on misconfigured servers to write web shells, escalating from data theft to remote code execution.

Root Cause

The root cause is the absence of prepared statements or parameter binding in the shopGoods function. The keyword argument is concatenated into a SQL query string rather than passed as a bound parameter. Input validation routines do not enforce a character allowlist or escape SQL metacharacters before the query executes.

Attack Vector

An attacker sends an HTTP POST request to the Taokeyun store endpoint that invokes the shopGoods action. By embedding SQL syntax in the keyword field, the attacker breaks out of the original query context. No prior authentication or user interaction is required, and the attack succeeds over the network against any exposed instance running version 1.0.5 or earlier.

The vulnerability mechanism is described in the VulDB advisory for VDB-250586 and the researcher's published security note. No verified proof-of-concept code is reproduced here.

Detection Methods for CVE-2024-0481

Indicators of Compromise

HTTP POST requests to Taokeyun store endpoints containing SQL metacharacters such as ', --, UNION, SLEEP(, or INFORMATION_SCHEMA inside the keyword parameter
Unexpected database error responses returned to clients from /index/app/store/Goods routes
Anomalous outbound database query volumes or response sizes from the Taokeyun web tier
Web server access logs showing repeated POST requests from a single source targeting the shopGoods action

Detection Strategies

Deploy web application firewall rules that inspect POST bodies for SQL injection signatures targeting the keyword parameter
Enable MySQL general query logging and alert on queries containing tautologies like OR 1=1 or UNION SELECT originating from the Taokeyun application user
Correlate web access logs with database error logs to identify reconnaissance patterns preceding successful injection

Monitoring Recommendations

Forward web server, PHP-FPM, and MySQL logs to a centralized analytics platform for retroactive hunting
Baseline normal request rates against /app/store/Goods.php and alert on statistical deviations
Monitor for new files written under the web root, which may indicate INTO OUTFILE abuse following injection

How to Mitigate CVE-2024-0481

Immediate Actions Required

Restrict network access to Taokeyun administrative and store endpoints using IP allowlists or VPN gating until a fix is applied
Deploy WAF signatures that block SQL injection payloads in POST parameters, with specific rules for the keyword field
Audit MySQL accounts used by Taokeyun and revoke FILE privileges to prevent file-write escalation
Review database and web server logs for prior exploitation attempts dating back to January 2024

Patch Information

No vendor patch is referenced in the NVD entry or VulDB advisory for CVE-2024-0481. Operators running Taokeyun 1.0.5 or earlier should contact the vendor for an updated release or apply manual code remediation. The fix requires rewriting the shopGoods function to use parameterized queries or the framework's query builder with bound parameters instead of string concatenation.

Workarounds

Manually patch application/index/controller/app/store/Goods.php to validate that keyword contains only alphanumeric characters before passing it to the database layer
Replace direct SQL string interpolation with prepared statements using PDO or the ThinkPHP query builder
Disable or remove the vulnerable storefront search endpoint if it is not required for business operations

bash

# Example ModSecurity rule to block SQL injection in the keyword parameter
SecRule ARGS:keyword "@detectSQLi" \
    "id:1004810,\
    phase:2,\
    deny,\
    status:403,\
    msg:'CVE-2024-0481 Taokeyun SQLi attempt in keyword parameter',\
    tag:'attack-sqli'"