CVE-2024-2591: Amss++ SQL Injection Vulnerability

CVE-2024-2591 Overview

CVE-2024-2591 is a SQL injection vulnerability affecting AMSS++ version 4.31. The flaw resides in the /amssplus/modules/book/main/bookdetail_group.php endpoint, where multiple parameters are passed unsanitized into backend SQL queries. A remote, unauthenticated attacker can craft malicious SQL payloads to read arbitrary data from the underlying database. The vulnerability is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. Spain's national CSIRT, INCIBE, published the original advisory describing this and other related issues in the AMSS++ product line.

Critical Impact
Unauthenticated remote attackers can extract the full contents of the application database through crafted HTTP requests to the vulnerable endpoint.

Affected Products

AMSS++ version 4.31
/amssplus/modules/book/main/bookdetail_group.php component
Deployments exposing the AMSS++ web interface to untrusted networks

Discovery Timeline

2024-03-18 - CVE-2024-2591 published to the National Vulnerability Database (NVD)
2025-04-17 - Last updated in NVD database

Technical Details for CVE-2024-2591

Vulnerability Analysis

The vulnerability is a classic in-band SQL injection in the AMSS++ book module. The script bookdetail_group.php accepts multiple HTTP parameters and concatenates their values directly into SQL statements without parameterization or input validation. An attacker who reaches the endpoint over the network can append SQL operators such as UNION SELECT to enumerate tables, dump credentials, or exfiltrate sensitive records.

No authentication is required, and exploitation does not depend on user interaction. The flaw is confidentiality-impacting: integrity and availability of the database are not directly altered by the documented attack path, though follow-on actions remain possible depending on database privileges.

Root Cause

The root cause is the absence of prepared statements or input sanitization in the affected PHP module. User-controlled parameters submitted to bookdetail_group.php are interpolated into SQL queries as raw strings. This pattern allows query structure manipulation through standard SQL metacharacters such as the single quote, semicolon, and comment sequences.

Attack Vector

Exploitation occurs over the network against the HTTP interface of the AMSS++ application. The attacker sends a crafted GET or POST request to /amssplus/modules/book/main/bookdetail_group.php containing malicious SQL fragments in one of the vulnerable parameters. Refer to the INCIBE Security Notice on Vulnerabilities in AMSS++ for the technical disclosure.

Detection Methods for CVE-2024-2591

Indicators of Compromise

HTTP requests to /amssplus/modules/book/main/bookdetail_group.php containing SQL keywords such as UNION, SELECT, SLEEP, BENCHMARK, or comment markers like -- and #.
Unusual response sizes or HTTP 500 errors originating from the AMSS++ book module.
Database query logs showing malformed or unusually long SQL statements tied to the book module.

Detection Strategies

Deploy a web application firewall (WAF) rule set that inspects parameter values sent to AMSS++ endpoints for SQL injection signatures.
Enable verbose database query logging and alert on syntax errors associated with the AMSS++ application user.
Correlate web server access logs with database logs to identify time-aligned anomalous queries.

Monitoring Recommendations

Monitor outbound data volumes from servers hosting AMSS++ to detect bulk database exfiltration.
Track repeated requests from a single source IP targeting the bookdetail_group.php script.
Alert on authentication failures or privilege errors raised by the database engine that reference the AMSS++ service account.

How to Mitigate CVE-2024-2591

Immediate Actions Required

Restrict network access to the AMSS++ web interface using firewall rules or VPN-only access until a fix is applied.
Apply WAF signatures that block SQL injection patterns aimed at /amssplus/modules/book/main/bookdetail_group.php.
Review database and web server logs for prior indicators of exploitation against the affected endpoint.

Patch Information

At the time of NVD publication, no vendor patch URL is referenced for AMSS++ 4.31. Consult the INCIBE advisory and the AMSS++ vendor for fixed releases or remediation guidance before redeploying the application.

Workarounds

Place the AMSS++ application behind an authenticating reverse proxy to prevent unauthenticated reach to vulnerable parameters.
Reduce the privileges of the database account used by AMSS++ to the minimum required, limiting the data exposed if exploitation succeeds.
Disable or remove the bookdetail_group.php module if it is not required for business operations.

bash

# Example NGINX rule to block obvious SQLi payloads to the vulnerable endpoint
location /amssplus/modules/book/main/bookdetail_group.php {
    if ($args ~* "(union.*select|sleep\(|benchmark\(|--|/\*)") {
        return 403;
    }
    proxy_pass http://amssplus_backend;
}