CVE-2024-5958: Elizsoftware Panel SQLi Vulnerability

CVE-2024-5958 Overview

CVE-2024-5958 is a SQL injection vulnerability in Eliz Software Panel that allows attackers to execute operating system commands through crafted SQL statements. The flaw affects all Panel versions before v2.3.24 and is tracked under CWE-89. An authenticated attacker with low privileges can inject SQL commands over the network, escalating to command line execution on the underlying host. The vulnerability received a CVSS 4.0 score of 9.4, reflecting high impact to confidentiality, integrity, and availability of both the vulnerable component and downstream systems. Turkey's national cyber incident response team (USOM) issued advisory TR-24-1497 documenting the issue.

Critical Impact
Attackers with low-privilege access can execute arbitrary operating system commands through SQL injection, resulting in full compromise of the Eliz Software Panel host.

Affected Products

Eliz Software Panel versions prior to v2.3.24
CPE: cpe:2.3:a:elizsoftware:panel:*:*:*:*:*:*:*:*
Component: elizsoftware:panel

Discovery Timeline

2024-09-18 - CVE-2024-5958 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-5958

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw where user-supplied input reaches SQL query construction without proper sanitization or parameterization. What elevates the impact beyond typical data exposure is that the injection path enables command line execution. This behavior typically occurs when the database engine exposes functions that shell out to the operating system, such as xp_cmdshell on Microsoft SQL Server or sys_exec via UDF on MySQL. The attacker leverages the injection to invoke these functions and run arbitrary commands under the database service account.

The issue affects the Eliz Software Panel web application. Exploitation requires network access and low-privilege authentication, but no user interaction. Turkey's USOM issued national advisory TR-24-1497 to notify local operators.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The Panel constructs SQL queries by concatenating untrusted input rather than using prepared statements with bound parameters. Additionally, the database service appears to run with sufficient privileges to execute operating system commands, compounding the impact of the injection.

Attack Vector

An attacker authenticates to the Eliz Software Panel with a low-privilege account, then submits crafted input to a vulnerable request parameter. The input breaks out of the intended SQL statement context and appends attacker-controlled SQL. That secondary SQL invokes a command execution primitive exposed by the database engine, allowing the attacker to run shell commands on the database host. From there, attackers can establish persistence, pivot to internal systems, or exfiltrate data.

No verified exploitation code is publicly available. The vulnerability is described in prose only; see USOM Notification TR-24-1497 for the official advisory.

Detection Methods for CVE-2024-5958

Indicators of Compromise

Unexpected outbound network connections originating from the database or web application service account on the Panel host.
Web server access logs containing SQL metacharacters such as ', --, ;, UNION SELECT, or encoded variants targeting Panel endpoints.
Database audit logs showing invocation of command execution primitives such as xp_cmdshell, sys_exec, or COPY ... FROM PROGRAM.
New or unexpected child processes spawned by the database service (cmd.exe, powershell.exe, /bin/sh).

Detection Strategies

Enable database query logging and alert on execution of OS command primitives from application-tier accounts.
Deploy a web application firewall with SQL injection signatures tuned to Panel URL patterns.
Baseline process trees for the database service and alert on any shell or interpreter descendants.
Correlate authenticated Panel sessions with anomalous SQL error volumes or long-running queries.

Monitoring Recommendations

Forward web server, application, and database logs to a centralized analytics platform for correlation.
Monitor for privilege changes and new local accounts on the Panel server following authenticated sessions.
Track file writes to web-accessible directories that could indicate webshell deployment following command execution.

How to Mitigate CVE-2024-5958

Immediate Actions Required

Upgrade Eliz Software Panel to version v2.3.24 or later without delay.
Rotate all credentials stored in or accessible to the Panel database, including service and application accounts.
Review database and web server logs for indicators of prior exploitation, focusing on the period since the last known-good state.
Restrict network access to the Panel administrative interface to trusted management networks only.

Patch Information

The vendor addressed the vulnerability in Panel v2.3.24. Operators should consult the Siber Güvenlik Notification TR-24-1497 for the official remediation guidance. No public vendor advisory URL beyond the Turkish national CERT notifications is currently referenced in the CVE record.

Workarounds

Disable database features that expose OS command execution, such as xp_cmdshell on SQL Server or user-defined functions on MySQL.
Run the database service under a least-privilege account with no permissions to invoke shell commands or write outside data directories.
Place the Panel behind a web application firewall configured to block SQL injection patterns until patching is complete.
Enforce strong authentication and network segmentation to reduce the pool of low-privilege accounts that could exploit the flaw.

bash

# Example: disable xp_cmdshell on Microsoft SQL Server
EXEC sp_configure 'show advanced options', 1;
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 0;
RECONFIGURE;