CVE-2024-32493

What it actually does

Authenticated SQL injection in the draft form ID parameter of an AJAX request allows a logged-in agent to execute arbitrary SQL statements against the backend database, resulting in full read, write, and delete capabilities on stored data.

Why it matters to the business

Attackers with agent credentials could extract or alter sensitive customer and ticket information, disrupt operations, or pivot to further system compromise, leading to data breaches and compliance violations.

How an attack unfolds

An attacker authenticates as an agent, identifies the draft form AJAX endpoint, and supplies a malicious payload in the draft form ID parameter that alters the intended SQL query structure to execute attacker-controlled statements.

How to fix it

Upgrade Znuny LTS to version 6.5.8 or later and Znuny to version 7.0.17 or later. Apply vendor patches that sanitize or parameterize the draft form ID input. Restrict database permissions for the application account as a defense-in-depth measure.

How to confirm the fix worked

Verify the deployed version is outside the vulnerable ranges (LTS 6.5.1-6.5.7 and 7.0.1-7.0.16). Test the draft form AJAX endpoint with known benign and malicious input patterns in a non-production environment to confirm parameterization prevents injection.

Typical attack path

1. Obtain valid agent credentials
2. Locate the draft form AJAX request endpoint
3. Craft and send requests containing SQL injection payloads in the draft form ID parameter
4. Observe database responses or side effects to confirm execution and exfiltrate or modify data

How to detect it

Inspect web server and application logs for AJAX requests to the draft form endpoint containing unusual characters, SQL keywords, or syntax anomalies in the form ID parameter. Correlate with database logs showing unexpected query structures or errors from the application user.

What your security team should do

• Prioritize upgrade to fixed versions immediately given the high CVSS score and authenticated remote attack vector
• Review and harden agent account privileges and monitor for unusual database query patterns
• Implement web application firewall rules to block obvious SQL injection patterns in AJAX parameters until patches are applied