CVE-2024-2622: Kelixin Command Dispatch SQLi Vulnerability

CVE-2024-2622 Overview

A critical SQL injection vulnerability has been discovered in Fujian Kelixin Communication Command and Dispatch Platform versions up to 20240318. The vulnerability exists in the /api/client/editemedia.php file, where improper handling of the number and enterprise_uuid parameters allows attackers to inject malicious SQL commands. This flaw can be exploited remotely without authentication, potentially allowing complete database compromise.

Critical Impact

This SQL injection vulnerability enables unauthenticated remote attackers to execute arbitrary SQL commands against the backend database, potentially leading to unauthorized data access, data manipulation, and complete system compromise.

Affected Products

• Fujian Kelixin Communication Command and Dispatch Platform (versions up to 20240318)
• Kelixin Communication Command and Dispatch Project

Discovery Timeline

• 2024-03-19 - CVE-2024-2622 published to NVD
• 2025-02-27 - Last updated in NVD database

Technical Details for CVE-2024-2622

Vulnerability Analysis

This SQL injection vulnerability exists in the /api/client/editemedia.php endpoint of the Fujian Kelixin Communication Command and Dispatch Platform. The application fails to properly sanitize user-supplied input in the number and enterprise_uuid parameters before incorporating them into SQL queries. This lack of input validation allows attackers to inject arbitrary SQL syntax that gets executed directly against the underlying database.

The vulnerability is particularly dangerous because it requires no authentication and can be exploited remotely over the network. An attacker with network access to the affected system can craft malicious HTTP requests containing SQL injection payloads in the vulnerable parameters, enabling them to bypass authentication, extract sensitive data, modify or delete database contents, and potentially execute operating system commands if the database is configured with elevated privileges.

Root Cause

The root cause of this vulnerability is improper input validation and lack of parameterized queries in the /api/client/editemedia.php file. The application directly concatenates user-supplied values from the number and enterprise_uuid parameters into SQL query strings without proper sanitization or the use of prepared statements. This violates secure coding practices defined in CWE-89 (SQL Injection) and allows attackers to manipulate query logic by inserting malicious SQL syntax.

Attack Vector

The attack can be initiated remotely over the network against the vulnerable API endpoint. An attacker sends crafted HTTP requests to /api/client/editemedia.php with malicious SQL payloads injected into either the number or enterprise_uuid parameter. Since no authentication is required to access this endpoint, any network-accessible attacker can exploit this vulnerability.

The exploitation involves techniques such as:

• Boolean-based blind SQL injection to extract data character by character
• Time-based blind SQL injection using database delay functions
• Union-based injection to retrieve data from other tables
• Stacked queries to execute multiple SQL statements if supported by the database

Technical details regarding the exploitation methodology are documented in the GitHub SQL Injection Vulnerability report.

Detection Methods for CVE-2024-2622

Indicators of Compromise

• Unusual HTTP requests to /api/client/editemedia.php with suspicious parameter values containing SQL syntax such as single quotes, UNION statements, OR conditions, or time-based functions
• Database error messages in web application logs indicating SQL syntax errors
• Unexpected database queries or data access patterns in database audit logs
• Outbound network connections from the database server indicating potential data exfiltration

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block common SQL injection patterns in requests to /api/client/editemedia.php
• Enable detailed logging for the affected endpoint and monitor for requests containing SQL keywords in the number and enterprise_uuid parameters
• Deploy database activity monitoring to detect anomalous query patterns or unauthorized data access
• Configure intrusion detection systems (IDS) with signatures for SQL injection attack patterns

Monitoring Recommendations

• Monitor HTTP access logs for requests to /api/client/editemedia.php with abnormally long parameter values or encoded SQL syntax
• Enable database audit logging to track all queries executed against sensitive tables
• Set up alerts for multiple failed authentication attempts or database errors following API requests
• Review web server error logs for SQL-related exceptions that may indicate exploitation attempts

How to Mitigate CVE-2024-2622

Immediate Actions Required

• Restrict network access to the Fujian Kelixin Communication Command and Dispatch Platform to trusted IP addresses only until a patch is applied
• Implement Web Application Firewall (WAF) rules to filter requests containing SQL injection patterns targeting /api/client/editemedia.php
• Disable or restrict access to the vulnerable /api/client/editemedia.php endpoint if it is not critical for operations
• Review database permissions and ensure the application database account has minimal required privileges

Patch Information

As of the last update date (2025-02-27), no official vendor patch information is publicly available. Organizations using the Fujian Kelixin Communication Command and Dispatch Platform should contact the vendor directly for security updates and patch availability.

For additional vulnerability tracking and updates, refer to:

• VulDB Entry #257199
• VulDB CTI ID #257199

Workarounds

• Deploy a reverse proxy or WAF in front of the application to filter malicious SQL injection payloads
• Implement input validation at the network perimeter using regex patterns to block requests with SQL syntax in the vulnerable parameters
• Apply network segmentation to isolate the affected system from critical network resources
• Consider taking the affected system offline if it processes sensitive data and no mitigation is feasible

# Example WAF rule for ModSecurity to block SQL injection attempts
SecRule ARGS:number|ARGS:enterprise_uuid "@detectSQLi" \
    "id:1001,\
    phase:2,\
    deny,\
    status:403,\
    log,\
    msg:'SQL Injection attempt blocked on editemedia.php',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}'"