CVE-2024-2621: Kelixin Command Platform SQLi Vulnerability

CVE-2024-2621 Overview

A critical SQL injection vulnerability has been identified in Fujian Kelixin Communication Command and Dispatch Platform versions up to 20240318. The vulnerability exists in the file api/client/user/pwd_update.php, where improper handling of the uuid parameter allows attackers to inject malicious SQL statements. This flaw can be exploited remotely without authentication, potentially allowing unauthorized access to sensitive database contents, modification of data, and complete system compromise.

Critical Impact

This unauthenticated SQL injection vulnerability allows remote attackers to execute arbitrary SQL commands against the backend database, potentially leading to complete data exfiltration, privilege escalation, and full system compromise.

Affected Products

• Fujian Kelixin Communication Command and Dispatch Platform (versions up to 20240318)
• Kelixin Communication Command and Dispatch Project

Discovery Timeline

• 2024-03-19 - CVE-2024-2621 published to NVD
• 2025-02-27 - Last updated in NVD database

Technical Details for CVE-2024-2621

Vulnerability Analysis

This vulnerability is a classic SQL injection (CWE-89) that occurs due to insufficient input validation in the password update functionality. The affected endpoint api/client/user/pwd_update.php accepts user-supplied input through the uuid parameter and directly incorporates it into SQL queries without proper sanitization or parameterized query implementation.

The vulnerability is particularly severe because it can be exploited remotely over the network without requiring any prior authentication or user interaction. Successful exploitation could allow an attacker to read, modify, or delete sensitive data stored in the database, bypass authentication mechanisms, escalate privileges, and potentially execute operating system commands depending on the database configuration and privileges.

Root Cause

The root cause of this vulnerability stems from the failure to properly sanitize or parameterize user input before including it in SQL queries. The uuid parameter in pwd_update.php is directly concatenated into SQL statements, creating a pathway for SQL injection attacks. This represents a fundamental violation of secure coding practices, where user-controlled data should never be trusted and must be validated and sanitized before use in database operations.

Attack Vector

The attack can be launched remotely against exposed instances of the Fujian Kelixin Communication Command and Dispatch Platform. An attacker would craft a malicious HTTP request to the api/client/user/pwd_update.php endpoint with a specially crafted uuid parameter containing SQL injection payloads. Since no authentication is required, any network-accessible deployment is potentially vulnerable.

Common attack payloads might include union-based injection to extract database contents, time-based blind injection for data exfiltration when direct output is not visible, or stacked queries to modify data or execute administrative database functions. The exploit details have been publicly disclosed, increasing the risk of active exploitation attempts.

Detection Methods for CVE-2024-2621

Indicators of Compromise

• Unusual HTTP requests to api/client/user/pwd_update.php with suspicious characters in the uuid parameter (single quotes, UNION, SELECT, semicolons)
• Database error messages in application logs indicating SQL syntax errors
• Unexpected database queries or access patterns in database audit logs
• Anomalous outbound network traffic from the database server indicating potential data exfiltration

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block SQL injection patterns in requests to the affected endpoint
• Enable detailed logging for the pwd_update.php endpoint and monitor for malformed uuid parameters
• Configure database activity monitoring to alert on suspicious query patterns or bulk data access
• Deploy intrusion detection signatures targeting known SQL injection attack patterns

Monitoring Recommendations

• Monitor web server access logs for requests containing SQL injection keywords (UNION, SELECT, DROP, INSERT, etc.) in the uuid parameter
• Set up alerts for multiple failed or anomalous requests to the password update endpoint
• Review database query logs for unusual statement patterns or execution times indicative of time-based blind injection attempts

How to Mitigate CVE-2024-2621

Immediate Actions Required

• Restrict network access to the Fujian Kelixin Communication Command and Dispatch Platform to trusted IP addresses only
• Deploy a web application firewall (WAF) with SQL injection protection rules in front of the vulnerable application
• Disable or remove the affected api/client/user/pwd_update.php endpoint if not operationally critical
• Audit database access logs for evidence of exploitation attempts

Patch Information

No official vendor patch information is currently available in the CVE data. Organizations should contact Fujian Kelixin Communication Co., Ltd. directly for guidance on available security updates. Monitor vendor communications and security advisories for patch releases. For additional technical details, refer to the GitHub SQL Injection Vulnerability writeup and VulDB entry #257198.

Workarounds

• Implement server-side input validation to reject any uuid parameter values containing special SQL characters
• Use parameterized queries or prepared statements when interacting with the database from the affected endpoint
• Deploy network segmentation to isolate the vulnerable system from critical infrastructure
• Consider taking the affected endpoint offline until a proper fix can be implemented

# Example: Block access to vulnerable endpoint using Apache .htaccess
<Files "pwd_update.php">
    Order deny,allow
    Deny from all
    # Allow only trusted IP addresses
    Allow from 192.168.1.0/24
</Files>