CVE-2024-2566: Kelixin Command Dispatch SQLi Vulnerability

CVE-2024-2566 Overview

A critical SQL injection vulnerability has been discovered in the Fujian Kelixin Communication Command and Dispatch Platform. This vulnerability affects the api/client/get_extension_yl.php file, where improper handling of the imei parameter allows attackers to inject malicious SQL queries. The vulnerability can be exploited remotely without authentication, enabling unauthorized access to sensitive database contents, data manipulation, and potential complete system compromise.

Critical Impact

This SQL injection vulnerability allows unauthenticated remote attackers to execute arbitrary SQL commands against the backend database, potentially leading to complete data breach, unauthorized data modification, and system takeover.

Affected Products

• Fujian Kelixin Communication Command and Dispatch Platform (versions up to 20240313)
• Kelixin Communication Command and Dispatch Project - Kelixin Communication Command and Dispatch

Discovery Timeline

• 2024-03-17 - CVE-2024-2566 published to NVD
• 2025-03-05 - Last updated in NVD database

Technical Details for CVE-2024-2566

Vulnerability Analysis

This vulnerability is classified as CWE-89 (SQL Injection), a critical web application security flaw that occurs when user-controlled input is incorporated into SQL queries without proper sanitization or parameterization. In this case, the imei parameter in the get_extension_yl.php API endpoint is directly concatenated into SQL queries, allowing attackers to manipulate the query logic.

The vulnerability is particularly severe because it can be exploited remotely over the network, requires no authentication or user interaction, and has the potential to compromise confidentiality, integrity, and availability of the affected system's data. The exploit has been publicly disclosed, as documented in VulDB Entry #257065, increasing the risk of widespread exploitation.

Root Cause

The root cause of this vulnerability is insufficient input validation and lack of parameterized queries in the api/client/get_extension_yl.php file. The application directly incorporates the imei parameter value into SQL statements without proper sanitization, escaping, or the use of prepared statements. This allows specially crafted input to break out of the intended query context and execute arbitrary SQL commands.

Attack Vector

The attack can be launched remotely via network access to the vulnerable API endpoint. An attacker would craft a malicious HTTP request to the api/client/get_extension_yl.php endpoint with a manipulated imei parameter containing SQL injection payloads. Since no authentication is required, any network-accessible instance of this platform is potentially vulnerable.

Typical attack scenarios include:

• Extracting sensitive data from the database using UNION-based injection
• Bypassing authentication mechanisms through boolean-based blind injection
• Modifying or deleting database records via stacked queries
• Potentially achieving remote code execution if database permissions allow file operations or command execution

The vulnerability details have been documented in the GitHub SQL Injection Vulnerability Report which provides technical specifics about the exploitation method.

Detection Methods for CVE-2024-2566

Indicators of Compromise

• Unusual or malformed requests to the api/client/get_extension_yl.php endpoint
• HTTP requests containing SQL keywords (SELECT, UNION, INSERT, UPDATE, DELETE) in the imei parameter
• Database error messages appearing in application logs or HTTP responses
• Unexpected database query patterns or slow query logs showing injection attempts
• Unauthorized data access or modifications in database audit logs

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the imei parameter
• Implement application-layer logging for all requests to the vulnerable endpoint with full parameter capture
• Configure database activity monitoring to alert on unusual query patterns or error rates
• Use intrusion detection systems (IDS) with SQL injection signature rules targeting this specific endpoint
• Enable verbose logging on the web server to capture full request details for forensic analysis

Monitoring Recommendations

• Monitor web server access logs for requests to get_extension_yl.php with suspicious imei parameter values
• Set up alerts for database errors that may indicate injection attempts (syntax errors, permission denied messages)
• Track and alert on unusual database query execution times that may indicate time-based blind SQL injection
• Monitor for any new database users, permission changes, or unexpected data exports
• Implement real-time alerting for any access to sensitive database tables outside normal application patterns

How to Mitigate CVE-2024-2566

Immediate Actions Required

• Restrict network access to the Fujian Kelixin Communication Command and Dispatch Platform to trusted IP addresses only
• Deploy a Web Application Firewall (WAF) with SQL injection protection rules in front of the application
• Implement input validation on the imei parameter to accept only expected IMEI format (typically 15-17 numeric digits)
• Review and audit database permissions to ensure the application uses least-privilege access
• Enable comprehensive logging and monitoring for the vulnerable endpoint

Patch Information

As of the last NVD update on 2025-03-05, no official vendor patch information is available. Organizations should contact Fujian Kelixin Communication Co., Ltd. directly for patch availability and update to a version later than 20240313 when available. Monitor the VulDB entry and vendor communications for patch announcements.

Workarounds

• Implement a reverse proxy or WAF rule to filter and block SQL injection patterns in the imei parameter before requests reach the application
• Restrict access to the api/client/get_extension_yl.php endpoint to authenticated and authorized users only
• Apply network segmentation to isolate the vulnerable system from critical infrastructure and sensitive data
• If the affected functionality is not essential, consider temporarily disabling or removing the get_extension_yl.php file
• Implement database-level query monitoring and blocking for suspicious patterns originating from the application

# Example WAF rule configuration (ModSecurity format)
# Block SQL injection attempts in imei parameter
SecRule ARGS:imei "@detectSQLi" \
    "id:1001,\
    phase:2,\
    deny,\
    status:403,\
    log,\
    msg:'SQL Injection attempt blocked in imei parameter - CVE-2024-2566',\
    tag:'application-multi',\
    tag:'language-multi',\
    tag:'platform-multi',\
    tag:'attack-sqli'"