SQLi in Eron Software's Wowwo CRM

The SQL Injection vulnerability in Wowwo CRM (CVE-2024-12150) poses a significant risk to data confidentiality and integrity. An attacker exploiting this flaw can bypass authentication mechanisms and directly query the database, potentially extracting sensitive customer data, financial records, and internal system configurations. The 'Blind SQL Injection' nature of the vulnerability means the attacker doesn't receive direct feedback from the database, requiring them to infer information through trial and error, but the potential impact remains severe. Successful exploitation could lead to complete compromise of the CRM system and associated data.

Organizations that rely on Wowwo CRM for customer relationship management and store sensitive data are at significant risk. This includes businesses of all sizes, particularly those using older, unpatched versions of the CRM. Shared hosting environments where multiple customers share the same server instance are also at increased risk, as a compromise of one customer's CRM instance could potentially impact others.

• php: Examine web server access logs for unusual SQL query patterns or error messages related to SQL syntax. Look for requests containing potentially malicious SQL code in GET or POST parameters.

grep -i 'sqlinjection|mysql_query' /var/log/apache2/access.log

• generic web: Use curl to test vulnerable endpoints with SQL injection payloads. Monitor the response for any signs of error messages or data leakage.

curl -X POST -d "username=' OR '1'='1" http://wowwo-crm/login.php

• database (mysql): Monitor MySQL logs for suspicious query patterns or error messages related to SQL syntax. Check for unauthorized access attempts to sensitive tables.

SELECT * FROM mysql.user WHERE user = 'attacker';

1. 2025-06-27Disclosure

   disclosure

1. 已保留2024-12-04
2. 发布日期2025-06-27
3. 修改日期2025-09-23
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2024-12150 is to immediately upgrade Wowwo CRM to version 0.0.1. If upgrading is not immediately feasible due to compatibility issues or downtime concerns, consider implementing a Web Application Firewall (WAF) with rules designed to detect and block SQL Injection attempts targeting the vulnerable endpoints. Carefully review and sanitize all user inputs to prevent malicious SQL code from being injected into database queries. Monitor database logs for suspicious activity, such as unusual query patterns or error messages related to SQL syntax. The vendor has not confirmed the fix, so thorough testing is essential after upgrading.