Description
The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Casdoor 1.13.0 - SQL Injection (Unauthenticated) EDB-50792 · webapps · Feb 28, 2022
GitHub 3 repositories
-
ColdFusionX/CVE-2022-24124 ★ 8 · Feb 25, 2022
POC for CVE-2022-24124
-
b1gdog/CVE-2022-24124 ★ 2 · Aug 31, 2022
CVE-2022-24124 exploit
-
abbarhissarh/CVE-2022-24124 ★ 1 · Jun 4, 2022
Dump SQL database version on host running Casdoor < 1.13.1
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Casdoor 1.13.0 - Unauthenticated SQL Injection http/cves/2022/CVE-2022-24124.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/casdoor/casdoor | < 1.13.1 | 1.13.1 | GHSA-m358-g4rp-533r |
| PyPI | casdoor | < 1.13.1 | 1.13.1 | PYSEC-2022-43189 |