Vulnerability record · CVE-2022-24124 · published 29 January 2022
CVE-2022-24124: Casdoor query API SQL injection via field and value parameters
Casbin · Casdoor
Casdoor before 1.13.1 contains a SQL injection flaw in its query API, reachable through the field and value parameters as shown by the api/get-organizations endpoint. Because the endpoint is network-facing and needs no credentials, an unauthenticated attacker can inject SQL into backend queries, which matters for any internet-exposed Casdoor deployment.
Description
The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Automated analysis
high priorityUnauthenticated network-reachable SQL injection with public exploit code and very high EPSS, though it is not listed in KEV and the CVSS impact is confidentiality-only.
What it is
Casdoor before 1.13.1 contains a SQL injection flaw in its query API, reachable through the field and value parameters as shown by the api/get-organizations endpoint. Because the endpoint is network-facing and needs no credentials, an unauthenticated attacker can inject SQL into backend queries, which matters for any internet-exposed Casdoor deployment.
Impact
An attacker gains unauthorized read access to the underlying database, exposing data returned by injected queries. The CVSS vector rates confidentiality as high with no integrity or availability impact.
Attack surface
Reached over the network via the query API, specifically api/get-organizations, using the field and value parameters. The vector AV:N/AC:L/PR:N/UI:N indicates no authentication and no user interaction are required.
Exploitation
Public exploit code exists, referenced by Packet Storm and the linked GitHub issue and pull request. The CVE is not in CISA KEV, but EPSS is 0.55295 (99th percentile), indicating high predicted exploitation activity.
What to do
- Upgrade Casdoor to 1.13.1 or later, which contains the fix referenced in the release comparison and pull request 442.
- If immediate upgrade is not possible, restrict network access to the query API and api/get-organizations to trusted sources only.
- Validate and parameterize the field and value parameters server-side rather than concatenating them into SQL.
- Audit database accounts used by Casdoor and apply least privilege to limit what injected queries can read.
Detection
- Monitor requests to api/get-organizations and other query API endpoints for SQL metacharacters or unusual field and value parameter payloads.
- Review database logs for anomalous or unexpected SELECT statements originating from the Casdoor application.
- Alert on access to the query API from untrusted or unexpected source IPs.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://packetstormsecurity.com/files/166163/Casdoor-1.13.0-SQL-Injection.html | ExploitThird Party AdvisoryVDB Entry |
| https://github.com/casdoor/casdoor/compare/v1.13.0...v1.13.1 | Release NotesThird Party Advisory |
| https://github.com/casdoor/casdoor/issues/439 | ExploitIssue TrackingPatchThird Party Advisory |
| https://github.com/casdoor/casdoor/pull/442 | ExploitPatchThird Party Advisory |
| http://packetstormsecurity.com/files/166163/Casdoor-1.13.0-SQL-Injection.html | ExploitThird Party AdvisoryVDB Entry |
| https://github.com/casdoor/casdoor/compare/v1.13.0...v1.13.1 | Release NotesThird Party Advisory |
| https://github.com/casdoor/casdoor/issues/439 | ExploitIssue TrackingPatchThird Party Advisory |
| https://github.com/casdoor/casdoor/pull/442 | ExploitPatchThird Party Advisory |
Track CVE-2022-24124 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-24124), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
