CVE-2024-9789: Lylme Spage SQL Injection Vulnerability

CVE-2024-9789 Overview

CVE-2024-9789 is a SQL injection vulnerability in LyLme_spage version 1.9.5, a PHP-based navigation portal application. The flaw resides in /admin/apply.php, where the id parameter is passed to a database query without proper sanitization. Attackers with authenticated access can manipulate the id argument to inject arbitrary SQL statements. The vulnerability is remotely exploitable over the network and has been publicly disclosed. The vendor was contacted prior to disclosure but did not respond. The issue is categorized under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated attackers can execute arbitrary SQL queries against the backend database, leading to disclosure, modification, or deletion of administrative data.

Affected Products

LyLme_spage 1.9.5
/admin/apply.php endpoint
Deployments exposing the admin interface to untrusted networks

Discovery Timeline

2024-10-10 - CVE-2024-9789 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9789

Vulnerability Analysis

The vulnerability exists in the administrative script /admin/apply.php within LyLme_spage 1.9.5. The script accepts an id request parameter and incorporates the value directly into a SQL statement without parameterized queries or input validation. This allows an authenticated administrator or an attacker who obtains admin credentials to inject arbitrary SQL fragments into the query context.

Successful exploitation can enumerate database contents, extract stored credentials, modify records, or perform destructive operations against the underlying database. The attack requires network reachability to the admin panel and valid high-privilege credentials, which limits the exposure but does not eliminate the risk in environments where admin sessions can be hijacked or where credentials are weak.

According to the VulDB advisory, a public exploit disclosure exists for this issue. EPSS data as of 2026-08-18 places exploitation probability at 0.563% (percentile 44.145).

Root Cause

The root cause is missing input neutralization on the id parameter before it is concatenated into a SQL statement. The application does not use prepared statements or type-cast the value to an integer, allowing SQL metacharacters to alter the intended query structure.

Attack Vector

The attack vector is network based. An attacker sends a crafted HTTP request to /admin/apply.php with a malicious id parameter value. Because the endpoint sits behind administrative authentication, exploitation requires valid admin session credentials. Once inside the admin surface, the injected SQL executes with the database privileges of the application service account.

See the Shikangsi technical write-up for reproduction details.

Detection Methods for CVE-2024-9789

Indicators of Compromise

HTTP requests to /admin/apply.php containing SQL metacharacters such as single quotes, UNION, SELECT, SLEEP(, or comment sequences in the id parameter.
Unusual database errors returned from the admin application in web server logs.
Unexpected read or write activity against LyLme_spage database tables from the application service account.

Detection Strategies

Deploy web application firewall rules that flag SQL injection payloads targeting the id parameter on administrative endpoints.
Enable database query logging and correlate slow or malformed queries with inbound requests to /admin/apply.php.
Review authentication logs for anomalous admin logins preceding suspicious query patterns.

Monitoring Recommendations

Alert on repeated 500-series responses from /admin/apply.php that may indicate injection attempts triggering SQL syntax errors.
Track outbound data volumes from the database host to identify potential exfiltration.
Monitor admin session creation from unusual geolocations or IP ranges.

How to Mitigate CVE-2024-9789

Immediate Actions Required

Restrict network access to /admin/* paths to trusted management IP ranges only.
Rotate administrator credentials and enforce strong, unique passwords for all admin accounts.
Enable multi-factor authentication on the admin interface if the deployment supports it.
Audit database contents and admin activity logs for signs of prior exploitation.

Patch Information

No vendor patch has been published. The vendor did not respond to disclosure attempts according to the VulDB CTI advisory. Operators should treat the software as unpatched and apply compensating controls until an upstream fix is available or migrate to a maintained alternative.

Workarounds

Place the admin interface behind a VPN or reverse proxy that enforces authentication and IP allowlisting.
Deploy a WAF signature that blocks SQL injection patterns targeting the id parameter on /admin/apply.php.
Apply the principle of least privilege to the database account used by LyLme_spage so that injection cannot escalate to schema-level operations.
Consider forking the source and replacing the vulnerable query with a parameterized statement or explicit integer cast on id.

bash

# Example nginx snippet restricting admin path to a management subnet
location ~ ^/admin/ {
    allow 10.10.0.0/24;
    deny all;
    proxy_pass http://lylme_backend;
}