SQL injection in Casdoor - CVE-2022-24124
Published: March 2, 2022 / Updated: January 28, 2024
Vulnerability identifier: #VU60962
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-24124
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data passed via the "field" HTTP GET to "/api/get-organizations" URL. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.
Affected software
Casdoor
How to mitigate CVE-2022-24124
Install update from vendor's website.
Casdoor - update to 1.13.1
Links to Public Exploits and PoC-codes
- Exploit #9531 - CVE-2022-24124 (CVE-2022-24124 exploit) (January 28, 2024)
- Exploit #9249 - cve_2022_24124 (cve_2022_24124 exploit) (August 17, 2023)
- Exploit #8313 - CVE-2022-24124_POC (Casdoor是一个基于OAuth 2.0/OIDC 的中心化的单点登录（SSO）身份验证平台，此漏洞属于Sql注入漏洞，在查询API 存在与字段和值参数相关的SQL注入漏洞) (August 31, 2022)
- Exploit #7978 - CVE-2022-24124 (Dump SQL database version on host running Casdoor < 1.13.1) (June 6, 2022)
- Exploit #7808 - Casdoor 1.13.0 - SQL Injection (Unauthenticated) (May 13, 2022)
- Exploit #7404 - CVE-2022-24124 (POC for CVE-2022-24124) (March 2, 2022)