CVE-2024-2592: AMSS++ SQL Injection Vulnerability

CVE-2024-2592 Overview

CVE-2024-2592 is a SQL injection vulnerability in AMSS++ version 4.31. The flaw resides in /amssplus/modules/person/pic_show.php and stems from improper sanitization of the person_id parameter. A remote, unauthenticated attacker can craft a malicious SQL payload that the application appends to a backend query. Successful exploitation discloses arbitrary data from the underlying database, including records that the user is not authorized to read. The issue is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). Spanish CERT INCIBE coordinated public disclosure of the issue.

Critical Impact
Unauthenticated remote attackers can extract the entire AMSS++ database contents by injecting SQL through the person_id parameter of pic_show.php.

Affected Products

AMSS++ 4.31
Earlier AMSS++ 4.x builds sharing the same pic_show.php code path
Deployments exposing /amssplus/modules/person/pic_show.php to untrusted networks

Discovery Timeline

2024-03-18 - CVE-2024-2592 published to NVD
2025-04-17 - Last updated in NVD database

Technical Details for CVE-2024-2592

Vulnerability Analysis

The vulnerability resides in the picture display module of AMSS++. The script /amssplus/modules/person/pic_show.php accepts a person_id request parameter and uses it to look up the corresponding record. The application concatenates this user-controlled value into a SQL statement without parameterization or input validation. An attacker can therefore terminate the original query context and append additional SQL syntax, including UNION SELECT statements that read columns from any table accessible to the database account used by the web application.

The attack requires no authentication, no user interaction, and a single HTTP request over the network. Because the affected endpoint is reachable through GET parameters, exploitation can be automated with standard tooling and indexed by search engines that crawl exposed instances.

Root Cause

The root cause is direct concatenation of untrusted input into a SQL query. The pic_show.php handler does not use prepared statements, parameter binding, or type casting on person_id. Any non-numeric content passes unchanged into the database driver, allowing query structure manipulation.

Attack Vector

The attack vector is a single HTTP request to /amssplus/modules/person/pic_show.php with a tampered person_id value. Typical payloads use boolean-based, error-based, or UNION-based techniques to enumerate schema metadata and exfiltrate data. Confidentiality is impacted; integrity and availability are not directly affected because the endpoint serves read operations.

No verified proof-of-concept code is published. Refer to the INCIBE Security Notice for the official advisory.

Detection Methods for CVE-2024-2592

Indicators of Compromise

HTTP requests to /amssplus/modules/person/pic_show.php containing SQL meta-characters such as ', ", --, /*, UNION, or SELECT in the person_id parameter.
Repeated requests to the same endpoint with incrementing payloads, indicating automated tooling such as sqlmap.
Unusual outbound database query volume or large response sizes from the AMSS++ web server.

Detection Strategies

Deploy a web application firewall rule that flags non-numeric values in the person_id parameter on the AMSS++ application path.
Enable database query logging and alert on UNION SELECT or INFORMATION_SCHEMA references originating from the AMSS++ service account.
Correlate web access logs with database error logs to surface injection probes that trigger SQL syntax exceptions.

Monitoring Recommendations

Monitor authentication-free endpoints under /amssplus/modules/ for sustained scanning activity.
Track user-agents associated with SQL injection tooling against AMSS++ hosts.
Baseline normal response sizes for pic_show.php and alert on significant deviations indicating bulk data extraction.

How to Mitigate CVE-2024-2592

Immediate Actions Required

Restrict network access to /amssplus/modules/person/pic_show.php to trusted internal users until a patch is applied.
Apply WAF signatures that block SQL meta-characters in the person_id parameter.
Review database access logs for evidence of prior exploitation and rotate any credentials that may have been stored in the database.

Patch Information

No vendor patch URL is referenced in the NVD entry at the time of writing. Administrators should consult the INCIBE Security Notice for vendor coordination details and upgrade guidance. Until a fixed release is published, treat all AMSS++ 4.31 deployments as vulnerable.

Workarounds

Place the AMSS++ application behind an authenticating reverse proxy or VPN to remove unauthenticated exposure.
Configure the database account used by AMSS++ with least privilege, limiting it to the specific tables required by the application.
Add server-side input validation to enforce a strict numeric type on the person_id parameter before it reaches the query layer.

bash

# Example nginx rule to reject non-numeric person_id values
location /amssplus/modules/person/pic_show.php {
    if ($arg_person_id !~ "^[0-9]+$") {
        return 400;
    }
    proxy_pass http://amssplus_backend;
}