CVE-2024-2589: AMSS++ SQL Injection Vulnerability

CVE-2024-2589 Overview

CVE-2024-2589 is a SQL injection vulnerability in AMSS++ version 4.31. The flaw exists in /amssplus/modules/book/main/bookdetail_school_person.php and affects multiple request parameters. An unauthenticated remote attacker can submit crafted SQL queries to extract arbitrary data from the backend database. The weakness is classified as [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact

Remote, unauthenticated attackers can read the full contents of the application database by injecting SQL through vulnerable parameters in bookdetail_school_person.php.

Affected Products

• AMSS++ version 4.31
• Component: amssplus/modules/book/main/bookdetail_school_person.php
• Vendor: amss++_project

Discovery Timeline

• 2024-03-18 - CVE-2024-2589 published to the National Vulnerability Database (NVD)
• 2025-04-17 - Last updated in NVD database

Technical Details for CVE-2024-2589

Vulnerability Analysis

The vulnerable endpoint bookdetail_school_person.php accepts user-controlled input through multiple parameters and concatenates them into SQL statements without parameterization or sanitization. Because the application reaches the database with the attacker's payload intact, an attacker can alter query logic, append UNION SELECT statements, and exfiltrate arbitrary tables. The vulnerability requires no authentication and no user interaction, and it is exploitable over the network.

The CVSS vector reflects a confidentiality-only impact: the database contents can be read, but integrity and availability are not directly affected by this specific weakness. Even so, exposure of stored credentials, session tokens, or administrative records could enable follow-on attacks against the application.

Root Cause

The root cause is the direct interpolation of HTTP request parameters into SQL queries inside bookdetail_school_person.php. The application does not use prepared statements, parameter binding, or input validation. Any parameter consumed by the script becomes an injection sink.

Attack Vector

Exploitation is performed over HTTP/HTTPS against the AMSS++ web interface. The attacker issues a GET or POST request to /amssplus/modules/book/main/bookdetail_school_person.php with SQL metacharacters in one of the vulnerable parameters. Standard tooling such as boolean-based, time-based, error-based, or UNION-based injection techniques is sufficient. No credentials, MFA, or user interaction is required.

No public proof-of-concept code is referenced by the advisory. See the INCIBE Security Notice for vendor-coordinated technical details.

Detection Methods for CVE-2024-2589

Indicators of Compromise

• HTTP requests to /amssplus/modules/book/main/bookdetail_school_person.php containing SQL metacharacters such as ', ", --, ;, UNION, SELECT, SLEEP(, or BENCHMARK(.
• Unusually large HTTP response bodies from bookdetail_school_person.php, which can indicate UNION-based data extraction.
• Web server or database error messages referencing SQL syntax, MySQL, or PHP database functions in access logs.
• Repeated requests to the same parameter with incrementing payload lengths, consistent with automated tools such as sqlmap.

Detection Strategies

• Deploy WAF or reverse-proxy rules that inspect query strings and POST bodies destined for /amssplus/modules/book/ for SQL injection signatures.
• Enable database query logging and alert on queries originating from the AMSS++ service account that contain UNION SELECT, INFORMATION_SCHEMA, or sleep functions.
• Correlate authentication failures and 500-series HTTP responses from the AMSS++ host to surface probing activity.

Monitoring Recommendations

• Forward web server, application, and database logs to a centralized analytics platform and apply detections for SQL injection patterns against the AMSS++ URL paths.
• Monitor outbound traffic from the AMSS++ database host for unexpected volumes that may indicate bulk data exfiltration.
• Track access patterns by source IP and alert on a single IP issuing high-cardinality parameter variations against bookdetail_school_person.php.

How to Mitigate CVE-2024-2589

Immediate Actions Required

• Restrict access to AMSS++ 4.31 to trusted networks or behind a VPN until a vendor patch is applied.
• Place the application behind a web application firewall with SQL injection signatures enabled for the /amssplus/ path.
• Audit database accounts used by AMSS++ and remove unnecessary privileges such as FILE, SUPER, or write access to tables not required by the module.
• Review web and database logs for prior exploitation against bookdetail_school_person.php.

Patch Information

No vendor patch URL is listed in the NVD entry at the time of publication. Refer to the INCIBE Security Notice for vendor coordination details and upgrade guidance. Operators should contact the AMSS++ vendor for a fixed release of the book module.

Workarounds

• Block external access to /amssplus/modules/book/main/bookdetail_school_person.php at the web server or reverse proxy until a patched version is deployed.
• Add WAF rules that reject requests containing SQL metacharacters in parameters submitted to the vulnerable endpoint.
• Configure the AMSS++ database user with read-only access where possible and segment the database host from sensitive networks.
• Enforce least privilege on the application database account so that successful injection cannot read tables outside the AMSS++ schema.

# Example nginx rule to block the vulnerable endpoint at the edge
location = /amssplus/modules/book/main/bookdetail_school_person.php {
    deny all;
    return 403;
}