CVE-2024-39037: Airc Mynet SQL Injection Vulnerability

CVE-2024-39037 Overview

CVE-2024-39037 is an unauthenticated SQL injection vulnerability in AIRC MyNET versions up to v26.08.316. The flaw resides in the handling of the intmenu parameter, which is passed directly into a backend SQL query without proper sanitization. Remote attackers can inject arbitrary SQL statements over the network without authentication. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated attackers can extract or manipulate database contents by injecting SQL through the intmenu parameter, exposing application data and user records.

Affected Products

AIRC MyNET versions up to and including v26.08.316
CPE: cpe:2.3:a:airc:mynet:*:*:*:*:*:*:*:*
Deployments referenced under the AIRC MyNET product line

Discovery Timeline

2025-12-24 - CVE-2024-39037 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-39037

Vulnerability Analysis

The vulnerability exists in a request handler that accepts the intmenu parameter from HTTP requests. The parameter value is concatenated into a SQL statement without parameterization or input validation. Attackers craft malicious payloads that alter the query structure to read, modify, or enumerate arbitrary database records.

The issue is exploitable remotely with no authentication or user interaction. AIRC MyNET is deployed as a management platform, so the underlying database frequently contains configuration data, credentials, and operational records. A proof-of-concept exploit script is published at miguelsantareno.github.io.

Root Cause

The root cause is failure to neutralize special elements in SQL statements (CWE-89). The intmenu parameter is embedded into a dynamic SQL query using string concatenation rather than prepared statements. No allow-list validation restricts the parameter to expected integer values.

Attack Vector

Exploitation requires only a network-reachable MyNET instance and the ability to issue HTTP requests. An attacker submits a request containing SQL syntax within the intmenu parameter. The backend database processes the injected clauses, returning data or altering state based on the payload. Boolean-based, error-based, and UNION-based extraction techniques are all feasible against a classic string-concatenation SQLi flaw of this type.

See the published exploit script for parameter placement and request structure.

Detection Methods for CVE-2024-39037

Indicators of Compromise

HTTP requests to MyNET endpoints containing SQL keywords such as UNION, SELECT, SLEEP, or -- inside the intmenu parameter.
Unexpected database errors returned to clients or logged by the MyNET application layer.
Anomalous outbound data volume from the MyNET application server following crafted requests.
Requests to intmenu with non-integer values, encoded characters, or unusual length.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect the intmenu parameter for SQL metacharacters and injection patterns.
Enable database query logging and alert on syntactically malformed statements originating from the MyNET service account.
Correlate HTTP access logs with database audit logs to identify request-to-query patterns consistent with injection.

Monitoring Recommendations

Baseline normal intmenu parameter values and alert on deviations from expected numeric input.
Monitor authentication tables and privileged records for unexpected reads or modifications by the MyNET application user.
Forward web and database logs to a centralized analytics platform for retention and query-time detection.

How to Mitigate CVE-2024-39037

Immediate Actions Required

Restrict network exposure of MyNET instances to trusted networks or VPN-reachable segments until a fixed release is applied.
Contact AIRC directly to obtain a patched build superseding v26.08.316.
Deploy WAF signatures blocking SQL injection payloads targeting the intmenu parameter.
Review database and application logs for evidence of prior exploitation attempts.

Patch Information

No vendor advisory URL is published in the NVD entry at the time of writing. Administrators should engage AIRC support through the AIRC solutions page to confirm the fixed version and coordinate upgrades.

Workarounds

Place MyNET behind a reverse proxy or WAF that enforces strict input validation on intmenu (integer-only, bounded length).
Apply network access controls limiting the application to authenticated internal users.
Rotate database credentials used by the MyNET service if compromise is suspected, and audit database privileges to enforce least privilege.

bash

# Example WAF rule concept (ModSecurity-style) to block SQLi in intmenu
SecRule ARGS:intmenu "@rx (?i)(union|select|sleep|benchmark|--|/\*|;)" \
    "id:1000039037,phase:2,deny,status:403,log,msg:'CVE-2024-39037 SQLi attempt in intmenu'"