CVE-2024-9788: Lylme Spage SQL Injection Vulnerability

CVE-2024-9788 Overview

CVE-2024-9788 is a SQL injection vulnerability in LyLme_spage version 1.9.5. The flaw resides in the /admin/tag.php script, where the id parameter is passed to a database query without proper sanitization. Attackers can manipulate this parameter to inject arbitrary SQL statements against the backing database [CWE-89]. The issue requires authenticated access to the administrative interface but can be triggered remotely over the network. The exploit has been publicly disclosed, and the vendor did not respond to disclosure attempts. No official patch is currently available for LyLme_spage 1.9.5.

Critical Impact
Authenticated remote attackers can inject SQL statements through the id parameter in /admin/tag.php, exposing administrative database contents to unauthorized read, modification, or deletion.

Affected Products

LyLme_spage 1.9.5
Vendor: lylme
Component: /admin/tag.php

Discovery Timeline

2024-10-10 - CVE-2024-9788 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9788

Vulnerability Analysis

The vulnerability affects the tag management endpoint in the administrative interface of LyLme_spage, a lightweight navigation portal application. The id argument accepted by /admin/tag.php is concatenated into a SQL query without parameterization or input validation. An authenticated administrator-tier attacker can supply crafted values that alter the query structure. Successful exploitation grants read and write access to the underlying database, including credential tables, tag records, and site configuration. According to the disclosure, the exploit code is publicly available, increasing the likelihood of opportunistic abuse against exposed instances.

Root Cause

The root cause is missing input sanitization on the id GET or POST parameter in /admin/tag.php. The application constructs SQL statements through string concatenation instead of using prepared statements or parameterized queries. This design pattern maps directly to CWE-89, Improper Neutralization of Special Elements used in an SQL Command.

Attack Vector

The attack requires network access to the admin panel and valid high-privilege credentials. An attacker sends a crafted HTTP request to /admin/tag.php with a malicious id value containing SQL metacharacters such as single quotes, UNION SELECT clauses, or time-based payloads. The database interprets the injected syntax as part of the original query. Refer to the VulDB entry #279940 and the Shikangsi Wiki post for the published proof of concept.

Detection Methods for CVE-2024-9788

Indicators of Compromise

Web server access logs showing requests to /admin/tag.php with SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( in the id parameter.
Unusually long response times on /admin/tag.php requests, indicating possible time-based blind SQL injection.
Database error strings returned in HTTP responses referencing MySQL syntax errors from the tag module.
Unexpected new administrator accounts or modified tag records in the LyLme_spage database.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that flag SQL keywords appearing in the id parameter of /admin/tag.php.
Enable database query logging and alert on statements originating from the tag module that contain multiple statements or UNION operators.
Correlate authentication events with subsequent tag.php requests to detect compromised administrator sessions.

Monitoring Recommendations

Ingest web server and database logs into a centralized analytics platform and build detections for SQL injection patterns targeting /admin/tag.php.
Monitor egress traffic from the LyLme_spage host for signs of database exfiltration, such as large outbound POST bodies or DNS tunneling.
Alert on any modification of privileged database tables outside of scheduled maintenance windows.

How to Mitigate CVE-2024-9788

Immediate Actions Required

Restrict access to /admin/ paths using IP allowlists, VPN, or reverse-proxy authentication until a fix is applied.
Rotate all administrator credentials and audit the LyLme_spage user table for unauthorized accounts.
Review database backups and logs for signs of prior exploitation using the disclosed proof of concept.

Patch Information

No official vendor patch has been released. The vendor did not respond to disclosure attempts documented in VulDB submission #414574. Operators should consider migrating away from LyLme_spage 1.9.5 or applying a manual source-code fix that replaces string concatenation in /admin/tag.php with parameterized queries using PDO or mysqli prepared statements.

Workarounds

Apply WAF signatures that block SQL injection payloads on requests to /admin/tag.php, especially against the id parameter.
Enforce least-privilege database accounts so the web application cannot execute schema-modifying statements.
Place the administrative interface behind a secondary authentication layer such as HTTP basic auth or mutual TLS.
Disable the tag management feature if it is not required in the deployment.

bash

# Example nginx configuration to restrict /admin/ to a trusted network
location /admin/ {
    allow 10.0.0.0/24;
    deny all;
    auth_basic "Restricted";
    auth_basic_user_file /etc/nginx/.htpasswd;
}