CVE-2024-9790: Lylme Spage SQL Injection Vulnerability

CVE-2024-9790 Overview

CVE-2024-9790 is a SQL injection vulnerability in LyLme_spage version 1.9.5. The flaw resides in an unknown function of the file /admin/sou.php, where the id parameter is not properly sanitized before use in a SQL query. Attackers can exploit the issue remotely to manipulate database queries. The vulnerability has been publicly disclosed, and exploit details are available. The vendor was contacted before disclosure but did not respond. This weakness is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated attackers can inject arbitrary SQL statements through the id parameter in /admin/sou.php, potentially disclosing or modifying database contents on affected LyLme_spage 1.9.5 installations.

Affected Products

LyLme_spage 1.9.5
Vendor: lylme
Component: /admin/sou.php (id parameter)

Discovery Timeline

2024-10-10 - CVE-2024-9790 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9790

Vulnerability Analysis

CVE-2024-9790 is a SQL Injection vulnerability affecting the administrative interface of LyLme_spage 1.9.5. The vulnerable endpoint /admin/sou.php accepts an id parameter and passes its value into a SQL query without adequate input validation or parameterization. An attacker who supplies crafted SQL syntax through this parameter can alter the intended query structure. Because the endpoint is reachable over the network, exploitation does not require local access. However, the CVSS v4.0 vector indicates high privileges are required, meaning an attacker must possess valid admin-level credentials before triggering the flaw.

Once exploited, the attacker can read, modify, or delete rows in the underlying database. This includes credential tables, site configuration, and any user-supplied content stored by the application. The public disclosure of exploit information increases the likelihood of opportunistic attacks against exposed instances.

Root Cause

The root cause is improper neutralization of special SQL characters within the id parameter handler in /admin/sou.php. The application concatenates user-supplied input directly into a SQL statement instead of using prepared statements or parameterized queries. This classic [CWE-89] pattern allows syntactic escape from the intended query context.

Attack Vector

Exploitation requires an authenticated administrative session and network access to the admin panel. The attacker submits a request to /admin/sou.php with a payload appended to the id argument. Typical payloads use boolean-based, time-based, or UNION-based techniques to extract data. Refer to the VulDB entry #279942 and the Shikangsi Wiki Post for technical proof-of-concept details.

Detection Methods for CVE-2024-9790

Indicators of Compromise

Requests to /admin/sou.php containing SQL metacharacters such as single quotes, UNION, SELECT, SLEEP(, or comment sequences (--, #) in the id parameter.
Unusual database error messages returned by the LyLme_spage application logs following admin panel requests.
Unexpected outbound database queries or long-running queries originating from the LyLme_spage web process.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect requests to /admin/sou.php and block SQL syntax in the id parameter.
Enable database query logging and alert on anomalous queries issued by the LyLme_spage database user, such as queries referencing information_schema or repeated timing-based patterns.
Correlate authentication logs for the admin panel with SQL error spikes to identify credentialed abuse.

Monitoring Recommendations

Monitor HTTP access logs for repeated 4xx or 5xx responses on /admin/sou.php following requests with encoded payloads.
Track administrative account activity, including source IPs and session duration, to identify credential compromise that could enable exploitation.
Ingest web server and database logs into a centralized SIEM for cross-source correlation and retention.

How to Mitigate CVE-2024-9790

Immediate Actions Required

Restrict network access to the LyLme_spage admin interface using IP allow-lists or VPN gating until a patch is available.
Rotate administrative credentials and enforce strong, unique passwords to reduce the pool of attackers who can meet the privilege requirement.
Review database and application logs for evidence of prior exploitation of /admin/sou.php.

Patch Information

At the time of publication, no vendor patch is available. The vendor was contacted about this disclosure but did not respond. Monitor the LyLme_spage project references for future updates and consider migrating to an actively maintained alternative if a fix is not released.

Workarounds

Place the /admin/ path behind an authenticating reverse proxy that inspects and blocks SQL syntax in query parameters.
Apply WAF signatures targeting SQL injection patterns on the id parameter of /admin/sou.php.
Configure the database account used by LyLme_spage with least-privilege permissions, removing DROP, ALTER, and cross-database access rights.

bash

# Example nginx snippet to block SQL metacharacters on the vulnerable endpoint
location = /admin/sou.php {
    if ($arg_id ~* "('|\"|--|;|union|select|sleep|benchmark)") {
        return 403;
    }
    proxy_pass http://lylme_backend;
}