CVE-2024-7114: Tianchoy Blog SQLi Vulnerability

CVE-2024-7114 Overview

CVE-2024-7114 is a SQL injection vulnerability affecting Tianchoy Blog versions up to 1.8.8. The flaw resides in the /so.php file, where the search parameter is passed to a database query without proper sanitization. Remote attackers can exploit the vulnerability over the network with low privileges and no user interaction. The exploit details have been publicly disclosed, increasing the risk of opportunistic exploitation. According to the disclosure, the vendor was contacted but did not respond, and no official patch is currently available. The vulnerability is tracked in VulDB as entry VDB-272445 and maps to CWE-89.

Critical Impact
Unauthenticated or low-privileged remote attackers can manipulate the search parameter in /so.php to inject arbitrary SQL, potentially exposing or altering database contents.

Affected Products

Tianchoy Blog versions up to and including 1.8.8
The vulnerable component is the /so.php endpoint
No fixed version has been published by the vendor

Discovery Timeline

2024-07-26 - CVE-2024-7114 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7114

Vulnerability Analysis

The vulnerability is a SQL injection flaw in the search functionality of Tianchoy Blog. The application accepts a search argument through the /so.php script and concatenates it into a backend SQL statement without adequate validation or parameterization. An attacker can craft a request that alters the query logic, allowing extraction, modification, or deletion of data stored in the underlying database.

Because the endpoint is exposed to the network and requires only low privileges, exploitation is straightforward. The public availability of exploit details in the GitHub Security-Collections repository further lowers the barrier to attack. The EPSS probability is 0.588% with a percentile of 44.97, indicating measurable but not high near-term exploitation likelihood.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. User-controlled input from the search parameter flows directly into a SQL query without prepared statements or input filtering. This design flaw allows an attacker to break out of the intended query context and append arbitrary SQL syntax.

Attack Vector

An attacker sends a crafted HTTP request to the /so.php endpoint with a malicious payload in the search parameter. The vulnerability manifests when the server executes the tainted SQL statement. Exploitation does not require authentication elevation and can be automated against exposed instances. See the VulDB entry for additional technical detail.

Detection Methods for CVE-2024-7114

Indicators of Compromise

HTTP requests to /so.php containing SQL metacharacters such as single quotes, UNION SELECT, --, #, or SLEEP() in the search parameter
Unusually long query strings targeting the search endpoint from a single source IP
Web server logs showing HTTP 500 errors or unusual response times originating from /so.php requests
Outbound database connections or data volumes deviating from historical baselines

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the search parameter for SQL injection patterns
Enable database query logging and alert on unexpected UNION, INFORMATION_SCHEMA, or time-based function usage
Correlate web access logs with database audit logs to identify request-to-query anomalies
Perform authenticated dynamic application security testing (DAST) scans of the /so.php endpoint

Monitoring Recommendations

Monitor web access logs for repeated failed requests to /so.php from the same source
Track abnormal HTTP response sizes and status codes for the search endpoint
Alert on database errors emitted to the client that reveal query structure or schema information
Baseline normal search traffic patterns and flag statistical outliers

How to Mitigate CVE-2024-7114

Immediate Actions Required

Restrict public access to /so.php using network controls or authentication until a patch is available
Deploy WAF signatures that block SQL injection payloads targeting the search parameter
Review web server and database logs for signs of prior exploitation
Rotate database credentials if compromise is suspected

Patch Information

The vendor did not respond to the disclosure, and no official patch has been released. Organizations running Tianchoy Blog 1.8.8 or earlier should treat the software as unmaintained and consider migration to a supported alternative. Track updates through the VulDB advisory.

Workarounds

Place the application behind a reverse proxy configured with SQL injection filtering
Modify /so.php to use parameterized queries or prepared statements if source-level changes are feasible
Apply input validation that rejects non-alphanumeric characters in the search parameter
Enforce least-privilege database accounts so the web application cannot modify schema or read sensitive tables

bash

# Example ModSecurity rule blocking SQL injection attempts on /so.php
SecRule REQUEST_URI "@beginsWith /so.php" \
    "chain,phase:2,deny,status:403,id:1007114,msg:'CVE-2024-7114 SQLi attempt'"
    SecRule ARGS:search "@detectSQLi" "t:none,t:urlDecodeUni"