cbcvebase.
CVE-2024-31750
published 2024-04-19

CVE-2024-31750: SQL injection vulnerability in f-logic datacube3 v.1.0 allows a remote attacker to obtain sensitive information via the req_id parameter.

PriorityP182critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
19.42%
97.0th percentile
SQL injection vulnerability in f-logic datacube3 v.1.0 allows a remote attacker to obtain sensitive information via the req_id parameter.

Affected

1 ranges
VendorProductVersion rangeFixed in
f-logicdatacube3_firmware——

Detection & IOCsextracted from sources · hover to see the quote

url/admin/pr_monitor/getting_index_data.php↗
commandreq_id=1) UNION ALL SELECT CHAR(113,120,107,107,113)||CHAR(117,78,85,110,71,119,86,122,111,101,81,87,68,72,80,107,90,112,111,110,120,72,78,70,76,99,100,81,80,77,89,75,86,65,105,99,74,67,122,107)||CHAR(113,106,120,122,113),NULL,NULL-- sTqG↗
otherqxkkquNUnGwVzoeQWDHPkZponxHNFLcdQPMYKVAicJCzkqjxzq↗
  • →Detect POST requests to the vulnerable endpoint /admin/pr_monitor/getting_index_data.php with a manipulated req_id parameter containing SQL UNION injection syntax (e.g., closing parenthesis, UNION ALL SELECT, CHAR() functions, comment sequence '-- '). ↗
  • →Identify exploitation by matching the canary string 'qxkkquNUnGwVzoeQWDHPkZponxHNFLcdQPMYKVAicJCzkqjxzq' in HTTP response bodies, which is the decoded output of the CHAR()-encoded UNION payload used to confirm blind/error-based SQLi. ↗
  • →Target fingerprinting: use FOFA query title="DataCube3" to identify exposed F-logic DataCube3 v1.0 instances on the internet. ↗
  • →Confirmed exploitation responses will return HTTP 200 with Content-Type: application/json and contain the canary string in the body. ↗
  • ·The vulnerability is specific to F-logic DataCube3 v1.0; other versions are not confirmed affected. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.