CVE-2024-9293: Skyselang Yyladmin SQLi Vulnerability

CVE-2024-9293 Overview

CVE-2024-9293 is a SQL injection vulnerability in skyselang yyladmin through version 3.0. The flaw resides in the list function within /app/admin/controller/file/File.php, part of the application's Backend component. Attackers can manipulate the is_disable parameter to inject arbitrary SQL statements. The vulnerability is exploitable over the network by an authenticated low-privileged user and requires no user interaction. Public exploit details have been disclosed, increasing the likelihood of opportunistic exploitation against exposed yyladmin installations. The weakness is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated attackers can inject SQL through the is_disable parameter of the file list endpoint, exposing backend database contents and potentially enabling data tampering.

Affected Products

skyselang yyladmin versions up to and including 3.0
Component: Backend file management controller (/app/admin/controller/file/File.php)
Deployments exposing the administrative interface to untrusted networks

Discovery Timeline

2024-09-27 - CVE-2024-9293 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9293

Vulnerability Analysis

The vulnerability exists in the list function of /app/admin/controller/file/File.php, which handles backend file listing requests in yyladmin. The controller accepts an is_disable request parameter and incorporates its value into a database query without adequate sanitization or parameterization. An authenticated attacker with access to the admin backend can supply crafted SQL fragments through is_disable to alter query logic, extract data, or bypass filtering conditions.

The vulnerability affects confidentiality, integrity, and availability at a limited scope, consistent with typical injection into a bounded administrative query. Because the yyladmin backend is written in PHP and commonly deployed with MySQL, standard union-based and boolean-based injection techniques apply. The public disclosure of exploitation details raises the risk profile for internet-exposed instances.

Root Cause

The root cause is improper neutralization of user-supplied input before use in an SQL statement [CWE-89]. The is_disable argument is concatenated or interpolated into a database query rather than bound as a parameter. Server-side input validation does not enforce a strict type or allowlist for this field, allowing SQL metacharacters and clauses to pass through to the query builder.

Attack Vector

Exploitation requires network access to the yyladmin backend and valid low-privilege credentials. The attacker issues an HTTP request to the file list endpoint and replaces the expected value of is_disable (normally a boolean or integer flag) with a SQL payload. The application then executes the tampered query, returning injected results or side effects such as blind time-based responses.

The vulnerability manifests in the list action of the File.php controller when it processes the is_disable parameter. See the Gitee SQL Injection Article and VulDB #278785 for technical details of the disclosed exploit path.

Detection Methods for CVE-2024-9293

Indicators of Compromise

HTTP requests to /app/admin/controller/file/File.php or the mapped file list route containing SQL metacharacters in is_disable (single quotes, UNION, SLEEP(, AND 1=, --, /*)
Web server or PHP error logs referencing SQL syntax errors originating from the file list handler
Unusually long response times on the file list endpoint indicating blind time-based injection with SLEEP() or BENCHMARK()
Database audit log entries showing unexpected INFORMATION_SCHEMA queries from the yyladmin application user

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the is_disable parameter for SQL keywords and reject non-numeric values before they reach the application
Enable database query logging on the yyladmin backend and alert on queries containing UNION SELECT, INFORMATION_SCHEMA, or nested SELECT statements originating from the file list controller
Correlate authenticated admin session activity with anomalous request patterns targeting File.php list actions

Monitoring Recommendations

Monitor authentication logs for admin account logins from unfamiliar IP addresses that immediately access file management endpoints
Track HTTP 500 responses and PHP fatal errors tied to the file list route as early signals of injection probing
Alert on outbound database queries returning row counts or column counts far exceeding the expected file listing size

How to Mitigate CVE-2024-9293

Immediate Actions Required

Restrict access to the yyladmin administrative interface to trusted IP ranges or an internal management VLAN
Rotate credentials for all admin accounts and enforce strong password requirements plus multi-factor authentication where supported
Audit recent access logs for the file list endpoint to identify any prior exploitation attempts referencing is_disable
Cast or validate is_disable as a strict integer or boolean at a reverse proxy or WAF layer until code-level fixes are applied

Patch Information

At the time of publication, no vendor advisory or fixed release is documented for skyselang yyladmin in the referenced sources. Administrators should track the VulDB entry #278785 and the upstream yyladmin repository for updated releases. If a patched version becomes available, upgrade to a release higher than 3.0 that explicitly addresses the is_disable parameter handling in File.php.

Workarounds

Apply a virtual patch at the WAF layer that rejects any value of is_disable other than 0 or 1
Modify the affected controller locally to bind is_disable as a typed parameter through the query builder rather than string interpolation
Configure the database account used by yyladmin with least-privilege permissions, removing rights to read INFORMATION_SCHEMA or other databases
Temporarily disable the backend file management module for accounts that do not require it

bash

# Example WAF rule (ModSecurity) restricting is_disable to a single digit
SecRule ARGS:is_disable "!@rx ^[01]$" \
    "id:1009293,phase:2,deny,status:400,\
    msg:'CVE-2024-9293: invalid is_disable value',\
    tag:'sqli',tag:'yyladmin'"