CVE-2022-24124 SQL Injection in Casdoor

What is CVE-2022-24124?

CVE-2022-24124 is a high-severity SQL injection vulnerability in n/a, published on 29 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.

Weakness: CWE-89

Which versions are affected by CVE-2022-24124?

4 open source packages ship an affected version, including github.com/casdoor/casdoor and casdoor. It affects 1 product.

Products include Casbin Casdoor.

How do I fix CVE-2022-24124?

Upgrade github.com/casdoor/casdoor to 1.13.1 or later.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2022-24124 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-24124 exists.

Public exploit code: 1 Exploit-DB entry, 1 Nuclei template and 3 proofs of concept on GitHub.

Other vulnerabilities in n/a

• CVE-2022-38638 Casdoor arbitrary file write vulnerability Critical 9.1
• CVE-2024-41657 GHSL-2024-035: Casdoor CORS misconfiguration High 8.1
• CVE-2022-44942 Casdoor arbitrary file deletion vulnerability via uploadFile function High 8.1
• CVE-2024-41264 casdoor's use of`ssh.InsecureIgnoreHostKey()` disables host key verification High 7.5
• CVE-2023-34927 Casdoor Cross-Site Request Forgery vulnerability Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m358-g4rp-533r, GO-2022-0303, PYSEC-2022-43189.