## https://sploitus.com/exploit?id=1E1023DA-9496-50F0-929B-6D147ED7567B
# CVE-2024-50330: Ivanti Endpoint Manager (EPM) SQL Injection to RCE
## Overview
CVE-2024-50330 is a **critical** pre-authentication SQL injection vulnerability in Ivanti Endpoint Manager (EPM) that allows a remote unauthenticated attacker to achieve remote code execution on the target server. The vulnerability was disclosed and patched in the November 2024 security update.
## Technical Details
- **CVE**: CVE-2024-50330
- **CWE**: CWE-89 (SQL Injection)
- **CVSS**: Critical (CVSS 3.x score ~9.8)
- **Attack Vector**: Network
- **Authentication**: None required
- **Impact**: Remote Code Execution
The flaw exists in an unauthenticated endpoint within the Ivanti EPM web interface. By injecting malicious SQL queries via crafted HTTP requests to a vulnerable parameter, an attacker can manipulate backend SQL queries against the Microsoft SQL Server database. This can be leveraged to enable `xp_cmdshell` and execute arbitrary operating system commands.
## Affected Versions
All versions of Ivanti Endpoint Manager prior to the November 2024 security update.
## Reproduction
### Prerequisites
- Target running a vulnerable version of Ivanti EPM
- Network access to the EPM web interface
- Python 3.x with `requests` library
## PoC
The provided `exploit.py` demonstrates:
1. UNION-based SQL injection to extract database information
2. Enabling `xp_cmdshell` via SQL injection
3. Executing arbitrary system commands
4. Time-based blind injection as a fallback technique
## Mitigation
- Apply the Ivanti November 2024 security update immediately
- Restrict network access to EPM management interfaces
- Monitor for anomalous SQL queries and command execution
- Implement Web Application Firewall (WAF) rules to detect SQLi patterns
## References
- [Ivanti Security Advisory](https://forums.ivanti.com/s/article/Security-Advisory-EPM-November-2024)
- [CVE-2024-50330](https://nvd.nist.gov/vuln/detail/CVE-2024-50330)
- [CWE-89: SQL Injection](https://cwe.mitre.org/data/definitions/89.html)