Unauthenticated SQL Injection Found in i-Netsolution MLM Software Build

i-Netsolution Readymade Unilevel Ecommerce MLM software from the 2024-03-15 build contains a high-severity SQL injection vulnerability. The National Vulnerability Database rates CVE-2024-58393 as high severity with a CVSS score of 8.8.

What happened

The National Vulnerability Database describes the issue as an SQL injection weakness classified under CWE-89. This flaw exists in the i-Netsolution Readymade Unilevel Ecommerce MLM product, specifically the build dated March 15, 2024. The vulnerability allows unauthenticated attackers to manipulate database queries through the 'id' parameter in web requests.

According to the Shadowserver Foundation, exploitation evidence for this specific flaw was first observed on September 14, 2024. Attackers can send GET requests to the /product-details.php endpoint to trigger the vulnerability. They use boolean-based, stacked, or time-based SLEEP payloads within the 'id' parameter to extract database information.

Why it matters

This vulnerability is significant because it requires no authentication for exploitation. Attackers can directly interact with the database through standard web requests to the product details page. The ability to use stacked queries and time-based payloads suggests that attackers can both read data and potentially modify database structures or contents.

The Shadowserver Foundation’s observation confirms that the flaw is already being abused in the wild. This active exploitation increases the risk for any organization running the affected 2024-03-15 build. The high CVSS score reflects the ease of exploitation and the potential impact on data confidentiality and integrity.

What to watch

• Monitor web server logs for unusual GET requests to /product-details.php.
• Look for long or encoded strings in the 'id' parameter that resemble SQL syntax.
• Watch for unexpected delays in server response times that may indicate time-based attacks.
• Check for unauthorized database queries or changes in database contents.

Who needs to act first

Teams should immediately identify any instances of the i-Netsolution Readymade Unilevel Ecommerce MLM software running the 2024-03-15 build. Systems exposed to the internet require immediate attention due to the unauthenticated nature of the attack. Administrators should verify if the specific /product-details.php endpoint is accessible to external users. If the software is running in production, consider restricting access to that page via web application firewalls or network rules while investigating remediation options. Prioritize systems handling sensitive customer or financial data for immediate review.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: i-Netsolution

• Verify if your organization uses i-Netsolution Readymade Unilevel Ecommerce MLM software.
• Check the version or build date of the installed software against the affected 2024-03-15 build.
• Review web server logs for suspicious activity on the /product-details.php endpoint.
• Contact the vendor for guidance on patches or workarounds once available.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the severity of CVE-2024-58393?

The National Vulnerability Database rates CVE-2024-58393 as high severity with a CVSS score of 8.8.

Which software version is affected by this vulnerability?

The i-Netsolution Readymade Unilevel Ecommerce MLM software from the 2024-03-15 build is affected.

Is there a patch available for this SQL injection flaw?

No fix has been confirmed yet in the source material.