CVE-2024-2590 Overview
CVE-2024-2590 is a SQL injection vulnerability affecting AMSS++ version 4.31. The flaw resides in /amssplus/modules/mail/main/select_send.php, where the sd_index parameter is passed to a database query without proper sanitization. A remote, unauthenticated attacker can send a crafted request containing malicious SQL syntax to extract arbitrary data from the backend database. The vulnerability is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). Public exploitation has not been reported, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.
Critical Impact
Unauthenticated remote attackers can exfiltrate the entire contents of the AMSS++ database by injecting SQL through the sd_index parameter.
Affected Products
- AMSS++ 4.31
- AMSS++ deployments exposing /amssplus/modules/mail/main/select_send.php to untrusted networks
- Earlier AMSS++ versions sharing the vulnerable mail module code path
Discovery Timeline
- 2024-03-18 - CVE-2024-2590 published to NVD
- 2025-04-17 - Last updated in NVD database
Technical Details for CVE-2024-2590
Vulnerability Analysis
The vulnerability is an unauthenticated SQL injection in the AMSS++ mail module. The script select_send.php accepts the sd_index parameter from HTTP requests and concatenates it directly into a SQL statement executed against the application database. Attackers control the parameter value over the network without authentication or user interaction. Successful exploitation allows reading sensitive records such as user credentials, mail content, and configuration data stored in the database. The issue maps to CWE-89, and its EPSS score is 0.048%, reflecting a low observed exploitation likelihood at this time.
Root Cause
The root cause is missing input validation and lack of parameterized queries in the select_send.php handler. The sd_index value is treated as trusted SQL syntax rather than as a data literal. Any character that influences query structure, including single quotes, comments, and UNION keywords, reaches the database engine unfiltered.
Attack Vector
The attack vector is network-based. An attacker issues an HTTP request to the vulnerable endpoint with a malicious payload appended to sd_index. Typical exploitation patterns include boolean-based blind injection, UNION-based extraction against the targeted table, and time-based confirmation using database sleep functions. No credentials, prior access, or user interaction are required.
No verified public proof-of-concept code is available. Refer to the INCIBE Security Notice for vendor-coordinated technical details.
Detection Methods for CVE-2024-2590
Indicators of Compromise
- HTTP requests to /amssplus/modules/mail/main/select_send.php containing SQL metacharacters such as ', --, UNION, or SLEEP( in the sd_index parameter.
- Database error responses or unusually large result sets returned from the mail module endpoint.
- Repeated access to select_send.php from a single source with incrementing or encoded sd_index values, indicating automated injection tooling.
Detection Strategies
- Deploy Web Application Firewall signatures that flag SQL syntax in query parameters targeting select_send.php.
- Enable database query logging and alert on UNION SELECT, INFORMATION_SCHEMA, or BENCHMARK/SLEEP patterns originating from the AMSS++ database user.
- Correlate web server access logs with database audit logs to identify injection attempts that produced anomalous query execution times.
Monitoring Recommendations
- Monitor outbound traffic from the AMSS++ host for unexpected data volumes that could indicate database exfiltration.
- Track failed and successful authentication events that occur shortly after suspicious requests to the mail module.
- Forward web, application, and database logs to a centralized analytics platform for retrospective hunting against the indicators above.
How to Mitigate CVE-2024-2590
Immediate Actions Required
- Restrict network access to /amssplus/modules/mail/main/select_send.php to trusted internal users until a fixed version is deployed.
- Place AMSS++ behind a Web Application Firewall with rules blocking SQL injection patterns in the sd_index parameter.
- Review web server and database logs for prior exploitation attempts and rotate any credentials stored in the AMSS++ database.
Patch Information
At the time of NVD publication no vendor-supplied patch URL was listed. Administrators should consult the INCIBE Security Notice and contact the AMSS++ vendor to obtain a fixed release that replaces the vulnerable query with parameterized statements.
Workarounds
- Apply a reverse-proxy rule that rejects requests where sd_index contains non-numeric characters if the parameter is expected to be an integer.
- Restrict the AMSS++ database account to least privilege, removing access to tables outside the mail module to limit data exposure during exploitation.
- Disable or remove the vulnerable mail module if it is not required for business operations.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
