CVE-2024-9980: Formosasoft Ee-class SQLi Vulnerability

CVE-2024-9980 Overview

CVE-2024-9980 is a SQL injection vulnerability in the FormosaSoft ee-class learning management platform. The application fails to properly validate a specific page parameter before passing it to backend database queries. Authenticated attackers with regular user privileges can inject arbitrary SQL commands over the network. Successful exploitation allows adversaries to read, modify, and delete database contents. The flaw is tracked under CWE-89 and was disclosed through TW-CERT.

Critical Impact
A regular authenticated user can compromise the confidentiality, integrity, and availability of the entire ee-class database through crafted requests to a vulnerable page parameter.

Affected Products

FormosaSoft ee-class (all versions prior to the vendor patch)
Deployments exposing the vulnerable page parameter to authenticated users
Learning management environments running formosasoft:ee-class

Discovery Timeline

2024-10-15 - CVE-2024-9980 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9980

Vulnerability Analysis

The ee-class application accepts user-supplied input through a specific page parameter and concatenates that input into a SQL statement without sanitization or parameterization. Because the injection point sits behind authentication, an attacker must hold a valid low-privilege account. Once authenticated, the attacker can pivot from limited application access to full database read, write, and delete operations. The scope remains unchanged, but the impact on the underlying data store is complete.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. The vulnerable code path trusts a request parameter used to drive page navigation and includes it directly in a dynamically constructed query. No prepared statements, parameter binding, or input allow-listing protect the query context. Any user with a session cookie can supply SQL metacharacters that break out of the intended string literal.

Attack Vector

Exploitation occurs over the network against the web front end. The attacker authenticates with a normal account, then issues HTTP requests that place SQL payloads inside the vulnerable page parameter. Standard techniques such as UNION-based extraction, boolean-based blind inference, and stacked queries are all viable depending on the database driver. No user interaction is required beyond the attacker's own session. See the TW-CERT Security Advisory for vendor-confirmed details.

Detection Methods for CVE-2024-9980

Indicators of Compromise

HTTP requests to ee-class endpoints containing SQL metacharacters such as ', --, UNION SELECT, or information_schema in the page parameter
Unexpected SELECT, UPDATE, or DELETE activity in database audit logs originating from the application service account
Application error responses referencing SQL syntax errors returned to low-privilege user sessions
New or modified database records that do not correspond to legitimate application workflows

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the ee-class page parameter for SQL syntax patterns and reject anomalous payloads
Enable database query logging and alert on queries that reference sensitive tables from unexpected code paths
Correlate authenticated user session identifiers with the volume and type of SQL statements executed downstream

Monitoring Recommendations

Baseline normal request patterns for the vulnerable endpoint and alert on parameter values containing SQL keywords or encoded variants
Forward web server, application, and database logs to a central analytics platform for cross-source correlation
Monitor for privilege abuse indicators such as low-privilege accounts triggering administrative-scope data access

How to Mitigate CVE-2024-9980

Immediate Actions Required

Apply the vendor-supplied patch referenced in the TW-CERT Security Update as soon as possible
Restrict network access to ee-class administrative and course pages to trusted networks or VPN users during the patch window
Rotate database credentials and application secrets if exploitation is suspected
Audit recent database changes for unauthorized modifications or data exfiltration

Patch Information

FormosaSoft has released a fixed version of ee-class addressing the improper input validation on the vulnerable page parameter. Administrators should consult the TW-CERT Security Advisory for the specific fixed build and upgrade instructions. Upgrade in a staging environment first to verify compatibility with existing course data.

Workarounds

Place a WAF or reverse proxy in front of ee-class and block requests whose page parameter contains SQL syntax such as quotes, comment markers, or UNION
Enforce least privilege on the database account used by the application so that even a successful injection cannot reach tables outside the application schema
Temporarily disable the vulnerable page for regular user roles until the patch is applied

bash

# Example WAF rule (ModSecurity) to block SQL syntax in the page parameter
SecRule ARGS:page "@rx (?i)(union(\s|/\*.*\*/)+select|--|;|/\*|information_schema|sleep\s*\()" \
    "id:1009980,phase:2,deny,status:403,log,msg:'Possible CVE-2024-9980 SQLi against ee-class'"