CVE-2022-24124

Deeper analysis

Casdoor versions prior to 1.13.1 contain a SQL injection vulnerability in the query API, specifically involving unsanitized field and value parameters passed to endpoints such as api/get-organizations. The flaw is tracked as CWE-89 and carries a CVSS 3.1 base score of 7.5, reflecting network-accessible exploitation with no required credentials or user interaction that can disclose arbitrary database contents.

An unauthenticated remote attacker can supply crafted field and value inputs to the affected API to execute arbitrary SQL queries, enabling extraction of sensitive data stored by the Casdoor identity-management application. Because the vulnerable endpoints are reachable over HTTP or HTTPS without authentication, the attack can be launched from any network position that can reach the Casdoor instance.

Public references point to a fix released in version 1.13.1; the corresponding GitHub pull request and commit diff show remediation of the injection points, and the project issue tracker documents the original report. Administrators are advised to upgrade promptly and to restrict direct access to the query API until patches are applied.

The associated EPSS score has reached a peak of 0.6062 with a current value of 0.5999, indicating sustained exploitation interest after disclosure. Public proof-of-concept material is available on Packet Storm.