CVE-2024-8301: Gitapp Dingfanzu CMS SQL Injection Flaw

CVE-2024-8301 Overview

CVE-2024-8301 is a SQL injection vulnerability in dingfanzu CMS, a content management system maintained by gitapp. The flaw resides in the /ajax/checkin.php script, where the username parameter is passed to a database query without proper sanitization. Remote attackers can inject arbitrary SQL statements over the network without authentication or user interaction. The vendor uses a rolling release model, and version details for affected and patched releases are not published. The exploit has been disclosed publicly through VulDB and a GitHub research write-up. The vendor was contacted before disclosure but did not respond.

Critical Impact

Unauthenticated remote attackers can manipulate the username parameter in /ajax/checkin.php to execute arbitrary SQL against the backend database, exposing credentials and CMS data.

Affected Products

• gitapp dingfanzu CMS (rolling release up to commit 29d67d9044f6f93378e6eb6ff92272217ff7225c)
• Affected component: /ajax/checkin.php
• Vulnerable parameter: username

Discovery Timeline

• 2024-08-29 - CVE-2024-8301 published to NVD
• 2024-08-30 - Last updated in NVD database

Technical Details for CVE-2024-8301

Vulnerability Analysis

The vulnerability is classified as SQL Injection under CWE-89. The checkin.php endpoint accepts a username argument from HTTP requests and concatenates it into a SQL query without parameterization or input validation. An attacker can inject SQL syntax such as UNION SELECT, boolean conditions, or time-based payloads to extract data from the backend database.

Exploitation requires no authentication, no user interaction, and can be launched remotely over the network. Successful exploitation can disclose stored credentials, session tokens, and other sensitive CMS data. Depending on database privileges, attackers may also modify records or escalate to file system access through database features.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command. The username parameter is interpolated directly into the SQL statement executed by checkin.php. The application does not use prepared statements or parameterized queries, and it does not apply allowlist validation to the parameter value.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request to /ajax/checkin.php with a malicious username value. The injected SQL fragment alters the structure of the underlying query. Public proof-of-concept material describing the request format is available in the GitHub SQL Injection Research write-up and the VulDB #276073 entry.

No verified exploitation code is included here. See the references above for technical reproduction details.

Detection Methods for CVE-2024-8301

Indicators of Compromise

• HTTP POST or GET requests to /ajax/checkin.php containing SQL meta-characters such as ', ", --, UNION, SLEEP(, or OR 1=1 in the username parameter.
• Unusually long response times from checkin.php consistent with time-based blind SQL injection.
• Web server logs showing high-frequency requests to /ajax/checkin.php from a single source.
• Database errors or stack traces referencing checkin.php in application or web server logs.

Detection Strategies

• Inspect web access logs for non-printable characters or SQL keywords in the username query string and POST body.
• Deploy a web application firewall (WAF) rule set covering OWASP Core Rule Set SQLi signatures targeting the /ajax/checkin.php path.
• Correlate authentication anomalies with requests to checkin.php to identify credential extraction attempts.

Monitoring Recommendations

• Enable verbose query logging on the database backend to identify malformed or unexpected SQL constructs originating from the CMS service account.
• Alert on outbound data transfers from the CMS server that exceed established baselines.
• Monitor for new administrative accounts or modified CMS records that may indicate post-exploitation activity.

How to Mitigate CVE-2024-8301

Immediate Actions Required

• Restrict network access to dingfanzu CMS administrative endpoints, including /ajax/checkin.php, using firewall rules or reverse proxy allowlists.
• Deploy a WAF in front of the CMS with rules blocking SQL injection patterns on the username parameter.
• Review web and database logs for prior exploitation attempts and rotate any credentials stored in the CMS database.

Patch Information

The vendor uses a rolling release model and did not respond to disclosure. No official patched version or commit identifier has been published. Organizations should track the upstream repository for fixes and review the VulDB advisory for updates.

Workarounds

• Apply a virtual patch at the WAF that blocks requests to /ajax/checkin.php containing SQL syntax in the username field.
• Modify checkin.php to use parameterized queries or prepared statements, and apply server-side input validation that constrains username to expected character classes.
• Run the CMS database account with least-privilege permissions so that successful injection cannot read or modify tables outside the CMS schema.
• Consider migrating to a maintained CMS until upstream fixes are confirmed.

# Example ModSecurity rule to block SQLi patterns on the vulnerable endpoint
SecRule REQUEST_URI "@streq /ajax/checkin.php" \
    "id:1008301,phase:2,deny,status:403,log,\
     msg:'CVE-2024-8301 dingfanzu CMS SQLi attempt',\
     chain"
  SecRule ARGS:username "@detectSQLi" "t:none,t:urlDecodeUni"