CVE-2024-22108: GTB Central Console SQLi Vulnerability

CVE-2024-22108 Overview

An unauthenticated SQL injection vulnerability was discovered in GTB Central Console version 15.17.1-30814.NG. The vulnerability exists in the setTermsHashAction method located at /opt/webapp/lib/PureApi/CCApi.class.php and is exploitable via the /ccapi.php endpoint. This flaw allows remote attackers to execute arbitrary SQL commands without any authentication, enabling them to modify the Administrator password to a known value and gain full administrative access to the console.

Critical Impact

Unauthenticated attackers can remotely exploit this SQL injection vulnerability to change the Administrator password and take complete control of the GTB Central Console, potentially compromising all data loss prevention (DLP) policies and monitored data.

Affected Products

• GTB Central Console 15.17.1-30814.NG
• gttb gtb_central_console

Discovery Timeline

• 2024-02-02 - CVE CVE-2024-22108 published to NVD
• 2025-06-05 - Last updated in NVD database

Technical Details for CVE-2024-22108

Vulnerability Analysis

This vulnerability falls under CWE-89 (SQL Injection), a critical class of web application vulnerability that occurs when user-supplied input is improperly incorporated into SQL queries. The vulnerable setTermsHashAction method in the CCApi class fails to properly sanitize or parameterize input before including it in database queries.

The attack is particularly dangerous because it requires no authentication whatsoever. An attacker with network access to the /ccapi.php endpoint can craft malicious SQL payloads that manipulate the underlying database. The ultimate impact documented in research indicates that attackers can leverage this flaw to directly modify the Administrator account password, effectively providing complete administrative control over the GTB Central Console infrastructure.

Root Cause

The root cause stems from improper input validation and lack of parameterized queries in the setTermsHashAction method within /opt/webapp/lib/PureApi/CCApi.class.php. User-controlled input is concatenated directly into SQL statements without proper sanitization, escaping, or the use of prepared statements. This allows attackers to break out of the intended query context and inject arbitrary SQL commands.

Attack Vector

The vulnerability is exploited remotely over the network without requiring any prior authentication or user interaction. An attacker sends specially crafted HTTP requests to the /ccapi.php endpoint containing malicious SQL payloads. These payloads target the setTermsHashAction method, which processes the input and passes it directly to database queries. By injecting SQL commands, the attacker can read, modify, or delete database contents, including sensitive credential information. The documented attack path specifically allows modification of the Administrator password hash to a known value, granting immediate administrative access.

For technical details on exploitation techniques, refer to the Adepts of0x Incident Report.

Detection Methods for CVE-2024-22108

Indicators of Compromise

• Unusual HTTP requests to /ccapi.php containing SQL metacharacters such as single quotes, double dashes, semicolons, or UNION keywords
• Unexpected password changes for the Administrator account without corresponding legitimate administrative activity
• Database query logs showing anomalous SQL statements or syntax errors indicative of injection attempts
• Authentication logs showing successful Administrator logins from unexpected IP addresses or locations

Detection Strategies

• Deploy web application firewalls (WAF) with SQL injection detection rules targeting the /ccapi.php endpoint
• Implement database activity monitoring to detect and alert on unusual queries against user credential tables
• Enable detailed logging on the GTB Central Console web server to capture all requests to the vulnerable endpoint
• Configure intrusion detection systems (IDS) to identify SQL injection attack patterns in HTTP traffic

Monitoring Recommendations

• Monitor network traffic for requests to /ccapi.php with suspicious payload characteristics
• Establish baseline Administrator login patterns and alert on deviations indicating potential account compromise
• Implement file integrity monitoring on critical configuration files and PHP class files
• Review web server access logs regularly for reconnaissance activity targeting API endpoints

How to Mitigate CVE-2024-22108

Immediate Actions Required

• Restrict network access to the /ccapi.php endpoint to trusted IP addresses only using firewall rules
• Place the GTB Central Console behind a properly configured web application firewall with SQL injection protection enabled
• Verify the integrity of the Administrator account password and change it if any compromise is suspected
• Review authentication logs for signs of unauthorized access and investigate any suspicious activity

Patch Information

Contact GTB Technologies directly to obtain information about available security patches for GTB Central Console. Review the X-C3LL CVE List and the Adepts of0x Incident Report for additional technical context regarding this vulnerability.

Workarounds

• Implement network segmentation to limit access to the GTB Central Console management interface
• Deploy a reverse proxy with strict input validation rules to filter malicious requests before they reach the application
• Disable or restrict access to the /ccapi.php endpoint if the PureApi functionality is not required for operations
• Enable enhanced logging and alerting to detect exploitation attempts while awaiting a permanent fix

# Example: Restrict access to ccapi.php via Apache configuration
<Location /ccapi.php>
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
    # Deny all other access
    Require all denied
</Location>