CVE-2022-24124
published 2022-01-29CVE-2022-24124: The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.
PriorityP271high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EXPLOIT
EPSS
58.93%
99.0th percentile
The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| casbin | casdoor | < 1.13.1 | 1.13.1 |
| github.com | casdoor_casdoor | >= 0 < 1.13.1 | 1.13.1 |
Detection & IOCsextracted from sources · hover to see the quote
url/api/get-organizations?p=123&pageSize=123&value=QualysWAS&sortField=&sortOrder=&field=updatexml(null,version(),null)↗
url/api/get-organizations?p=123&pageSize=123&value=cfx&sortField=&sortOrder=&field=updatexml(1,version(),1)
url/api/get-organizations?p=123&pageSize=123&value=cfx&sortField=&sortOrder=&field=updatexml(null,version(),null)↗
yara
regex: XPATH syntax error.*'
- →Exploit triggers an XPATH syntax error in the HTTP response body containing the string 'XPATH syntax error:' followed by SQL query output — match this pattern in response bodies to detect exploitation attempts. ↗
- →Monitor GET requests to /api/get-organizations where the 'field' parameter contains SQL/XPATH function calls such as updatexml() or extractvalue() — this endpoint is publicly accessible without authentication. ↗
- →Shodan/FOFA fingerprinting: identify exposed Casdoor instances via HTTP title 'Casdoor' or 'casdoor' to scope detection.
- →The exploit regex pattern used to confirm successful SQL injection is '(?i)(XPATH syntax error.*\')' — use this pattern in WAF/IDS rules against HTTP response bodies. ↗
- →The vulnerability is unauthenticated; no session or credentials are required. Any request to the affected endpoint with a crafted 'field' parameter should be treated as a high-confidence attack attempt. ↗
- ·The XPATH error output is truncated in the response, limiting direct data exfiltration per request; attackers can bypass this using substring() to extract data in chunks — detection rules should account for repeated requests with varying substring() offsets. ↗
- ·The fix in version 1.13.1 implements a whitelist character check via filterField() in object/check.go — deployments still running Casdoor < 1.13.1 remain fully exposed with no authentication barrier. ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
SQL Injection in Casdoor in github.com/casdoor/casdoor
osv·2024-08-21
CVE-2022-24124 SQL Injection in Casdoor in github.com/casdoor/casdoor
SQL Injection in Casdoor in github.com/casdoor/casdoor
SQL Injection in Casdoor in github.com/casdoor/casdoor
OSV
SQL Injection in Casdoor
osv·2022-02-01
CVE-2022-24124 [HIGH] SQL Injection in Casdoor
SQL Injection in Casdoor
The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.
GHSA
SQL Injection in Casdoor
ghsa·2022-02-01
CVE-2022-24124 [HIGH] CWE-89 SQL Injection in Casdoor
SQL Injection in Casdoor
The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.
No detection rules found.
Exploit-DB
Casdoor 1.13.0 - SQL Injection (Unauthenticated)
exploitdb·2022-02-28·CVSS 7.5
CVE-2022-24124 [HIGH] Casdoor 1.13.0 - SQL Injection (Unauthenticated)
Casdoor 1.13.0 - SQL Injection (Unauthenticated)
---
// Exploit Title: Casdoor 1.13.0 - SQL Injection (Unauthenticated)
// Date: 2022-02-25
// Exploit Author: Mayank Deshmukh
// Vendor Homepage: https://casdoor.org/
// Software Link: https://github.com/casdoor/casdoor/releases/tag/v1.13.0
// Version: version < 1.13.1
// Security Advisory: https://github.com/advisories/GHSA-m358-g4rp-533r
// Tested on: Kali Linux
// CVE : CVE-2022-24124
// Github POC: https://github.com/ColdFusionX/CVE-2022-24124
// Exploit Usage : go run exploit.go -u http://127.0.0.1:8080
package main
import (
"flag"
"fmt"
"html"
"io/ioutil"
"net/http"
"os"
"regexp"
"strings"
)
func main() {
var url string
flag.StringVar(&url, "u", "", "Casdoor URL (ex. http://127.0.0.1:8080)")
flag.Parse()
banner := `
-=Casdoor SQ
Nuclei
Casdoor 1.13.0 - Unauthenticated SQL Injection
nuclei·CVSS 7.5
CVE-2022-24124 [HIGH] Casdoor 1.13.0 - Unauthenticated SQL Injection
Casdoor 1.13.0 - Unauthenticated SQL Injection
Casdoor version 1.13.0 suffers from a remote unauthenticated SQL injection vulnerability via the query API in Casdoor before 1.13.1 related to the field and value parameters, as demonstrated by api/get-organizations.
Template:
id: CVE-2022-24124
info:
name: Casdoor 1.13.0 - Unauthenticated SQL Injection
author: cckuailong
severity: high
description: Casdoor version 1.13.0 suffers from a remote unauthenticated SQL injection vulnerability via the query API in Casdoor before 1.13.1 related to the field and value parameters, as demonstrated by api/get-organizations.
impact: |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized accessand data leakage.
remedi
Qualys
Casdoor SQL Injection (CVE-2022-24124) | Qualys
blogs_qualys·2022-03-09·CVSS 7.5
CVE-2022-24124 [HIGH] Casdoor SQL Injection (CVE-2022-24124) | Qualys
#### Table of Contents
- About CVE-2022-24124
- SQL Injection Analysis
- Exploitation POC
- Qualys PoC
- Detecting the vulnerability with Qualys WAS
- Report
- Solution
- Credits
- References:
On Jan 22, 2022, a high severity SQL Injection vulnerability was reported in Casdoor which affected versions before 1.13.1 release. The vulnerability is tracked as CVE-2022-24124 with CVSS V3 7.5 score has a publicly available simple proof of concept which makes it easier for skilled attackers to manually craft advance SQL queries and exploit this vulnerability.
Qualys Web Application Scanning has released a new QID 150470 which sends specially crafted request to the endpoint being tested to determine the vulnerability. The crafted request concatenates a SQL injection payload to the parameter of t
Qualys
Casdoor SQL Injection (CVE-2022-24124)
blogs_qualys·2022-03-09·CVSS 7.5
CVE-2022-24124 [HIGH] Casdoor SQL Injection (CVE-2022-24124)
## Table of Contents
About CVE-2022-24124
SQL Injection Analysis
Exploitation POC
Qualys PoC
Detecting the vulnerability with Qualys WAS
Report
Solution
Credits
References:
On Jan 22, 2022, a high severity SQL Injection vulnerability was reported in Casdoor which affected versions before 1.13.1 release. The vulnerability is tracked as CVE-2022-24124 with CVSS V3 7.5 score has a publicly available simple proof of concept which makes it easier for skilled attackers to manually craft advance SQL queries and exploit this vulnerability.
Qualys Web Application Scanning has released a new QID 150470 which sends specially crafted request to the endpoint being tested to determine the vulnerability. The crafted request concatenates a SQL injection payload to the parameter of the target ap
http://packetstormsecurity.com/files/166163/Casdoor-1.13.0-SQL-Injection.htmlhttps://github.com/casdoor/casdoor/compare/v1.13.0...v1.13.1https://github.com/casdoor/casdoor/issues/439https://github.com/casdoor/casdoor/pull/442http://packetstormsecurity.com/files/166163/Casdoor-1.13.0-SQL-Injection.htmlhttps://github.com/casdoor/casdoor/compare/v1.13.0...v1.13.1https://github.com/casdoor/casdoor/issues/439https://github.com/casdoor/casdoor/pull/442
2022-01-29
Published