CVE-2024-9560: Esafenet CDG SQL Injection Vulnerability

CVE-2024-9560 Overview

CVE-2024-9560 is a SQL injection vulnerability in ESAFENET CDG V5, a document security and encryption product. The flaw resides in the delCatelogs function accessed through /CDGServer3/document/Catelogs;logindojojs?command=DelCatelogs. Attackers manipulate the id parameter to inject SQL statements into backend database queries. The vulnerability is exploitable remotely and requires low privileges. Public disclosure of the exploit technique has occurred, increasing the risk of opportunistic exploitation. The weakness is classified under CWE-89, improper neutralization of special elements used in a SQL command.

Critical Impact
Authenticated remote attackers can inject arbitrary SQL through the id parameter of the delCatelogs endpoint, potentially exposing or modifying sensitive document management data.

Affected Products

ESAFENET CDG V5
Component: esafenet:cdg version 5
Endpoint: /CDGServer3/document/Catelogs;logindojojs?command=DelCatelogs

Discovery Timeline

2024-10-06 - CVE-2024-9560 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9560

Vulnerability Analysis

The vulnerability affects the delCatelogs function inside the CDG document management server. The application accepts an id argument through the DelCatelogs command handler at /CDGServer3/document/Catelogs;logindojojs. The parameter value is concatenated into a SQL statement without proper parameterization or sanitization. An attacker who supplies a crafted id value can break out of the intended query context and append arbitrary SQL clauses. Successful exploitation allows the attacker to read, modify, or delete database rows accessible to the application service account. The impact spans confidentiality, integrity, and availability of stored document metadata.

Root Cause

The root cause is improper neutralization of special elements in a SQL command [CWE-89]. The delCatelogs handler builds queries via string concatenation with the untrusted id request parameter. No prepared statements, bind variables, or input validation guard the input before it reaches the database driver.

Attack Vector

Exploitation requires network access to the CDG web interface and a low-privileged authenticated session. The attacker issues an HTTP request to the DelCatelogs command with a malicious id value. The logindojojs path segment appears to route the request through an authenticated context. Because the exploit has been publicly disclosed, automated scanners and opportunistic actors can weaponize the technique against exposed CDG deployments. See the VulDB entry #279368 for additional technical context.

No verified proof-of-concept code is available in trusted repositories, so exploitation payloads are not reproduced here. Refer to the vendor and third-party references for defensive detail.

Detection Methods for CVE-2024-9560

Indicators of Compromise

HTTP requests to /CDGServer3/document/Catelogs;logindojojs?command=DelCatelogs containing SQL metacharacters such as single quotes, UNION, SLEEP, or comment sequences in the id parameter.
Database error messages or unusually long response times returned from DelCatelogs requests, suggesting error-based or time-based injection.
Unexpected DELETE or SELECT activity from the CDG application database account outside normal document lifecycle patterns.

Detection Strategies

Deploy web application firewall (WAF) signatures that inspect the id query parameter on the DelCatelogs endpoint for SQL syntax tokens.
Enable database query logging on the CDG backend and alert on statements referencing catalog tables that contain unusual OR, UNION, or nested SELECT constructs.
Correlate authenticated session identifiers issuing DelCatelogs requests with anomalous frequency or off-hours activity.

Monitoring Recommendations

Forward CDG application, IIS/Tomcat, and reverse proxy access logs to a centralized SIEM for retention and query.
Monitor for elevated 4xx/5xx response rates on the Catelogs endpoint, which often accompany injection probing.
Baseline normal request volume for the DelCatelogs command and alert on statistical deviation.

How to Mitigate CVE-2024-9560

Immediate Actions Required

Restrict network exposure of the ESAFENET CDG V5 management interface to trusted internal networks or VPN access only.
Rotate credentials for all CDG user accounts and audit session logs for unauthorized DelCatelogs invocations.
Apply least-privilege database permissions to the CDG service account so it cannot read or modify tables outside the document catalog scope.

Patch Information

No vendor advisory or fixed version was published in the referenced sources at the time of writing. Contact ESAFENET support directly for a security update covering the delCatelogs handler. Track updates through the VulDB CTI record and the original disclosure.

Workarounds

Deploy a WAF rule that blocks or sanitizes requests to /CDGServer3/document/Catelogs;logindojojs when the id parameter contains non-numeric characters.
Add reverse-proxy input validation that enforces a strict numeric pattern (for example, ^[0-9]+$) for the id parameter before forwarding to the application server.
Disable or firewall the DelCatelogs command handler if catalog deletion is not required for normal operations.

bash

# Example nginx location block enforcing numeric id validation
location /CDGServer3/document/Catelogs {
    if ($arg_id !~ "^[0-9]+$") {
        return 400;
    }
    proxy_pass http://cdg_backend;
}