CVE-2024-0481: Jifeer Taokeyun SQLi Vulnerability

CVE-2024-0481 Overview

A critical SQL Injection vulnerability has been identified in Jifeer Taokeyun, an e-commerce platform. The vulnerability exists in the shopGoods function within the file application/index/controller/app/store/Goods.php, which is part of the HTTP POST Request Handler component. By manipulating the keyword argument, an unauthenticated remote attacker can inject arbitrary SQL commands, potentially leading to complete database compromise, data exfiltration, or system takeover.

Critical Impact

This SQL Injection vulnerability allows unauthenticated remote attackers to execute arbitrary SQL queries against the backend database, potentially compromising all stored data including customer information, credentials, and sensitive business data.

Affected Products

• Jifeer Taokeyun versions up to and including 1.0.5
• All deployments using the vulnerable shopGoods function in the Goods controller
• Systems exposing the HTTP POST Request Handler to untrusted networks

Discovery Timeline

• 2024-01-13 - CVE-2024-0481 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-0481

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) occurs due to improper neutralization of special elements used in SQL commands within the shopGoods function. The vulnerable code resides in application/index/controller/app/store/Goods.php and processes the keyword parameter from HTTP POST requests without adequate input sanitization.

When a user submits a search request through the store's goods search functionality, the keyword parameter is directly incorporated into SQL queries without proper parameterization or escaping. This allows attackers to break out of the intended query structure and execute arbitrary SQL commands with the privileges of the database user.

The vulnerability is particularly severe because it can be exploited remotely without any authentication, requires no user interaction, and provides attackers with direct access to manipulate the underlying database. Successful exploitation could result in unauthorized access to sensitive data, modification or deletion of database records, and potentially gaining control of the underlying server through database-specific features.

Root Cause

The root cause of this vulnerability is the failure to properly sanitize user-supplied input in the keyword argument before incorporating it into SQL queries. The shopGoods function in the Goods controller does not implement parameterized queries, prepared statements, or adequate input validation, allowing SQL metacharacters to be interpreted as part of the query structure rather than as literal data values.

Attack Vector

The attack can be launched remotely via network-based HTTP POST requests targeting the vulnerable endpoint. An attacker can craft malicious input containing SQL syntax within the keyword parameter to manipulate database queries. The exploit has been publicly disclosed, making it accessible to threat actors who may target unpatched Taokeyun installations.

The vulnerability affects the search functionality exposed through the store goods controller. By injecting specially crafted SQL payloads, attackers can perform various malicious actions including extracting database contents via UNION-based injection, executing time-based or boolean-based blind SQL injection attacks, or in severe cases, leveraging database features for remote code execution.

Technical details and proof-of-concept information are available through the ZhaoJin Note Share disclosure. Additional vulnerability intelligence can be found at VulDB #250586.

Detection Methods for CVE-2024-0481

Indicators of Compromise

• Unusual SQL error messages or stack traces appearing in application logs referencing the shopGoods function
• HTTP POST requests to the Goods controller containing SQL metacharacters such as single quotes, double dashes, UNION keywords, or semicolons in the keyword parameter
• Database audit logs showing unexpected queries, data exfiltration patterns, or attempts to access system tables
• Anomalous database activity such as bulk data extraction or schema enumeration queries

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in HTTP POST parameters, particularly targeting requests to /app/store/Goods.php
• Enable database query logging and monitor for suspicious query patterns including UNION SELECT statements, information_schema queries, or sleep/benchmark functions
• Deploy intrusion detection signatures to identify known SQL injection attack patterns targeting the keyword parameter
• Utilize SentinelOne Singularity platform for endpoint detection of post-exploitation activities that may follow successful SQL injection attacks

Monitoring Recommendations

• Configure centralized logging for all requests to the Taokeyun application with particular attention to the store goods search functionality
• Set up alerting for failed authentication attempts or unusual database account activity that may indicate credential theft via SQL injection
• Monitor for outbound data transfers that could indicate data exfiltration following successful exploitation
• Review database backup and export activities for unauthorized access patterns

How to Mitigate CVE-2024-0481

Immediate Actions Required

• Upgrade Jifeer Taokeyun to a patched version that addresses the SQL injection vulnerability if one is available
• Implement input validation on the keyword parameter to reject SQL metacharacters and enforce expected input patterns
• Deploy a Web Application Firewall with SQL injection protection rules in front of the vulnerable application
• Restrict network access to the Taokeyun application to trusted IP ranges where possible
• Review database permissions and ensure the application uses least-privilege database accounts

Patch Information

At the time of publication, no official vendor patch has been publicly documented for this vulnerability. Organizations should monitor the vendor's official channels for security updates addressing CVE-2024-0481. In the absence of an official patch, implementing the workarounds and compensating controls described below is critical.

For the latest vulnerability intelligence, consult VulDB CTI ID 250586.

Workarounds

• Implement prepared statements or parameterized queries in the shopGoods function to prevent SQL injection
• Apply strict input validation using allowlists for the keyword parameter, rejecting any special characters not required for legitimate search functionality
• Deploy a reverse proxy or WAF with SQL injection detection rules to filter malicious requests before they reach the application
• Consider temporarily disabling the affected search functionality until a proper fix can be implemented

# Example WAF rule for ModSecurity to block SQL injection attempts
SecRule ARGS:keyword "@detectSQLi" \
    "id:1001,\
    phase:2,\
    deny,\
    status:403,\
    msg:'SQL Injection attempt detected in keyword parameter',\
    log,\
    auditlog"