CVE-2024-2480: Mhasistemas Armhazena SQLi Vulnerability

CVE-2024-2480 Overview

CVE-2024-2480 is a SQL injection vulnerability affecting MHA Sistemas arMHAzena version 9.6.0.0. The flaw resides in the Executa Page component, where user-supplied input to the Companhia, Planta, Agente de, and Agente até parameters is passed to backend SQL queries without proper sanitization. Attackers with low-privilege network access can manipulate these parameters to inject arbitrary SQL statements. The issue is tracked as VDB-256888 and classified under CWE-89. The vendor was contacted before public disclosure but did not respond.

Critical Impact
Remote SQL injection allows attackers to read, modify, or delete backend database records, enabling data theft and potential lateral movement into connected systems.

Affected Products

MHA Sistemas arMHAzena 9.6.0.0
Component: Executa Page
Vulnerable parameters: Companhia, Planta, Agente de, Agente até

Discovery Timeline

2024-03-15 - CVE-2024-2480 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2480

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw located in the Executa Page component of arMHAzena 9.6.0.0. User input received through the Companhia (Company), Planta (Plant), Agente de, and Agente até request arguments is concatenated into SQL statements without parameterization or input validation.

An attacker sends crafted HTTP requests to the vulnerable endpoint with malicious SQL fragments embedded in these parameters. The application executes the resulting query against the backend database, returning attacker-controlled results or performing unauthorized data operations.

Exploitation requires only low-privilege authentication and no user interaction. Successful attacks can expose confidential warehouse and inventory data, alter database records, or degrade application availability. Public disclosure of the exploit details on VulDB increases the likelihood of opportunistic scanning against exposed instances.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The application fails to use prepared statements or parameterized queries, allowing input concatenation to modify query structure.

Attack Vector

The attack is remotely initiated over the network against the web-facing Executa Page endpoint. An authenticated user with low privileges can send malicious query strings targeting the affected parameters. See the GitHub SQL Injection Analysis and VulDB entry #256888 for technical details.

Detection Methods for CVE-2024-2480

Indicators of Compromise

HTTP requests targeting the Executa Page endpoint containing SQL metacharacters such as ', --, UNION SELECT, or OR 1=1 in the Companhia, Planta, Agente de, or Agente até parameters.
Anomalous database queries originating from the arMHAzena application service account, particularly UNION-based or time-based blind injection patterns.
Unusual outbound data volumes from the database server following requests to arMHAzena web endpoints.

Detection Strategies

Deploy Web Application Firewall (WAF) rules to inspect and block SQL injection payloads on parameters used by the Executa Page component.
Enable database query logging and alert on queries containing tautologies, stacked statements, or unusual INFORMATION_SCHEMA access from the application service account.
Correlate web server access logs with database audit logs to identify request-to-query patterns consistent with injection attempts.

Monitoring Recommendations

Monitor authentication logs for arMHAzena user accounts exhibiting abnormal request rates or failed queries.
Alert on HTTP 500 responses and database error messages returned to clients, which often accompany SQL injection probing.
Track database schema enumeration attempts, especially reads against system tables from the application context.

How to Mitigate CVE-2024-2480

Immediate Actions Required

Restrict network access to the arMHAzena application, limiting exposure to trusted internal networks or VPN users only.
Enforce least-privilege permissions on the database account used by arMHAzena, removing rights to modify schema or access unrelated databases.
Deploy WAF signatures to block SQL injection payloads targeting the affected parameters until a vendor patch is available.

Patch Information

No vendor patch has been published. According to the VulDB advisory, MHA Sistemas was contacted before disclosure but did not respond. Organizations running arMHAzena 9.6.0.0 should contact the vendor directly for remediation guidance and consider compensating controls.

Workarounds

Place the arMHAzena web interface behind a reverse proxy with strict input validation rules that reject SQL metacharacters in the vulnerable parameters.
Apply database-level controls such as query allowlisting, read-only replicas for reporting functions, and separate credentials per application component.
Increase logging verbosity on both application and database tiers to support incident investigation should exploitation occur.

bash

# Example WAF ModSecurity rule blocking SQLi patterns on Executa Page parameters
SecRule ARGS:Companhia|ARGS:Planta|ARGS:"Agente de"|ARGS:"Agente até" \
    "@rx (?i)(union(\s+all)?\s+select|--|;|/\*|\bor\b\s+\d+=\d+|\bxp_cmdshell)" \
    "id:1002480,phase:2,deny,status:403,log,msg:'CVE-2024-2480 arMHAzena SQLi attempt'"