CVE-2024-8749: I-doit Pro SQL Injection Vulnerability

CVE-2024-8749 Overview

CVE-2024-8749 is a SQL injection vulnerability [CWE-89] affecting i-doit pro version 28. The flaw resides in the ID parameter handled by /var/www/html/src/classes/modules/api/model/cmdb/isys_api_model_cmdb_objects_by_relation.class.php. An unauthenticated attacker can send a crafted query to extract data from the underlying database. The vulnerability is network-exploitable and requires no user interaction. i-doit is an IT documentation and configuration management database (CMDB) commonly deployed in enterprise asset management workflows, making exposed instances attractive targets for reconnaissance and credential harvesting.

Critical Impact
Unauthenticated remote attackers can extract arbitrary contents from the i-doit pro database, including asset inventories, configuration data, and any credentials stored within the CMDB.

Affected Products

i-doit pro version 28
Deployments exposing the i-doit API endpoint to untrusted networks
Installations using the isys_api_model_cmdb_objects_by_relation API model

Discovery Timeline

2024-09-12 - CVE-2024-8749 published to the National Vulnerability Database
2024-09-18 - Last updated in NVD database

Technical Details for CVE-2024-8749

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw in the i-doit pro REST API. The affected file isys_api_model_cmdb_objects_by_relation.class.php implements the model used to retrieve CMDB objects by relation. The ID parameter accepted by this endpoint is concatenated into a SQL statement without proper parameterization or sanitization. An attacker who supplies a crafted value for the ID parameter can break out of the intended query context and append arbitrary SQL clauses. Because the endpoint executes against the primary i-doit database, successful injection exposes the full contents of the CMDB schema. The vulnerability impacts confidentiality, while integrity and availability are not directly affected according to the published vector.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. The API model accepts the ID parameter from the request and incorporates it into a SQL query without using prepared statements or input validation. Any string passed through this parameter is interpreted as part of the SQL statement.

Attack Vector

An attacker sends a crafted HTTP request to the i-doit API targeting the cmdb.objects_by_relation method. The ID value contains SQL syntax such as UNION SELECT payloads or boolean-based extraction patterns. The server executes the malicious query and returns results in the API response, enabling data exfiltration over the network without authentication.

No verified public proof-of-concept code is available. Refer to the INCIBE Security Notice for additional technical details published by the coordinating CSIRT.

Detection Methods for CVE-2024-8749

Indicators of Compromise

HTTP POST or GET requests to the i-doit JSON-RPC API referencing the cmdb.objects_by_relation method with anomalous ID parameter values containing SQL keywords such as UNION, SELECT, SLEEP, or --
Unusual response sizes or response times from the i-doit API endpoint compared to baseline traffic
Database query logs showing malformed or non-numeric values reaching the objects_by_relation query path

Detection Strategies

Deploy web application firewall (WAF) rules that inspect requests to the i-doit API and flag SQL meta-characters in the ID parameter
Enable verbose database query logging on the MariaDB or MySQL backend and alert on syntactically invalid queries originating from the i-doit application user
Correlate API access logs with authentication state to identify unauthenticated requests reaching sensitive CMDB endpoints

Monitoring Recommendations

Monitor outbound traffic from the i-doit server for unexpected data egress that may indicate database exfiltration
Track API request volume to the objects_by_relation endpoint and alert on spikes from single source IPs
Audit i-doit access logs daily for requests containing URL-encoded SQL syntax in query parameters

How to Mitigate CVE-2024-8749

Immediate Actions Required

Restrict network access to the i-doit pro web interface and API using firewall rules or a reverse proxy with IP allowlisting
Contact the i-doit vendor (synetics) for a patched build and apply it once available
Rotate any credentials, API tokens, or secrets stored within the i-doit CMDB, since database contents may already be exposed
Review API access logs for evidence of exploitation attempts against the objects_by_relation endpoint

Patch Information

No vendor advisory URL was published in the NVD record at the time of writing. Administrators should consult the INCIBE Security Notice and the synetics i-doit release notes for fixed versions. Upgrade to a release that addresses the SQL injection in isys_api_model_cmdb_objects_by_relation.class.php as soon as it is available.

Workarounds

Disable the i-doit API if it is not required for integrations
Place the i-doit application behind a WAF configured with SQL injection signature detection on the ID parameter
Limit the database privileges of the i-doit application account to the minimum required, reducing the scope of data accessible through injection
Require VPN or mutual TLS authentication to reach the i-doit management interface from external networks

bash

# Example nginx snippet to block obvious SQLi payloads in the ID parameter
location /src/classes/modules/api/ {
    if ($args ~* "(\bunion\b|\bselect\b|--|;|/\*|\bsleep\()") {
        return 403;
    }
    proxy_pass http://idoit_backend;
}