CVE-2024-0988: Kuerp Authentication Bypass Vulnerability

CVE-2024-0988 Overview

CVE-2024-0988 is an improper authentication vulnerability [CWE-287] in Sichuan Yougou Technology KuERP versions up to 1.0.4. The flaw resides in the checklogin function within /application/index/common.php. Attackers can manipulate the App_User_id and App_user_Token parameters to bypass authentication controls. The exploit has been publicly disclosed and is network-accessible without user interaction. The vendor was contacted but did not respond to the disclosure, leaving deployed instances exposed. This issue was tracked as VDB-252253 prior to CVE assignment.

Critical Impact

Unauthenticated remote attackers can bypass authentication in KuERP, gaining access to confidentiality, integrity, and availability of the application.

Affected Products

• Sichuan Yougou Technology KuERP versions up to and including 1.0.4
• Component: /application/index/common.php
• Function: checklogin

Discovery Timeline

• 2024-01-29 - CVE-2024-0988 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-0988

Vulnerability Analysis

The vulnerability is an authentication bypass in the KuERP web application. The checklogin function in /application/index/common.php validates session state using two client-supplied parameters: App_User_id and App_user_Token. Manipulation of these values bypasses the authentication check, allowing unauthenticated network attackers to access protected functionality.

The weakness is classified under [CWE-287] Improper Authentication. Because the flaw is reachable over the network without privileges or user interaction, exploitation requires only an HTTP client capable of crafting the relevant request parameters.

No patched release is available. The vendor did not respond to the disclosure attempt, meaning the issue remains unpatched in shipped versions through 1.0.4. The EPSS exploitation probability is low, but the public availability of the technical disclosure raises the likelihood of opportunistic exploitation against exposed instances.

Root Cause

The root cause is trust in client-controlled identifier and token values without cryptographic verification or server-side session validation. The checklogin routine accepts App_User_id and App_user_Token from the request context and treats them as authoritative, rather than tying them to a server-validated session.

Attack Vector

The attack vector is network-based. An attacker sends crafted HTTP requests to a KuERP endpoint that invokes checklogin, supplying chosen values for App_User_id and App_user_Token. The vulnerability mechanism is documented in the public disclosure at ZhaoJ Info Sharing and VulDB #252253. No verified exploit code is republished here; refer to the disclosure for parameter-level details.

Detection Methods for CVE-2024-0988

Indicators of Compromise

• HTTP requests to KuERP endpoints containing unusual or sequential App_User_id values paired with static or guessable App_user_Token strings.
• Authenticated actions in application logs that lack a preceding successful login event.
• Access to administrative or privileged KuERP pages from source IP addresses that have no login history.

Detection Strategies

• Inspect web server access logs for repeated requests against /application/index/common.php flows that include the App_User_id and App_user_Token parameters.
• Correlate authenticated session activity with prior /login requests; absence of a login event before privileged actions indicates likely bypass.
• Deploy web application firewall (WAF) rules that flag requests where these parameters are externally supplied rather than originating from a server-issued cookie or session token.

Monitoring Recommendations

• Forward KuERP web server and application logs to a central analytics platform for behavioral baseline analysis.
• Alert on anomalous user ID enumeration patterns and high-volume requests to authentication-adjacent endpoints.
• Monitor outbound data flows from the KuERP host for signs of bulk data extraction following suspicious authentication events.

How to Mitigate CVE-2024-0988

Immediate Actions Required

• Restrict network exposure of KuERP instances to trusted internal networks or VPN-only access until a patch is available.
• Place KuERP behind a reverse proxy or WAF configured to block requests that supply App_User_id and App_user_Token from untrusted sources.
• Audit existing user accounts and recent activity for evidence of unauthorized access.

Patch Information

No vendor patch is available. The vendor did not respond to the disclosure. Organizations running KuERP 1.0.4 or earlier should evaluate alternative ERP platforms or apply compensating controls until a fix is released. Track upstream advisories via VulDB #252253.

Workarounds

• Enforce network-layer authentication (mTLS, VPN, or IP allowlisting) in front of the KuERP application.
• Add server-side middleware that re-validates session tokens against a server-side store and rejects requests where App_User_id and App_user_Token are passed as URL or body parameters.
• Disable or firewall off the affected endpoint paths if business workflows permit.

# Example nginx configuration to block external requests containing the vulnerable parameters
location /application/index/ {
    if ($args ~* "App_User_id=|App_user_Token=") {
        return 403;
    }
    proxy_pass http://kuerp_backend;
}