External risk intelligence

Cloudlog Time-Based Blind SQL Injection Vulnerability in Search Endpoint.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-44065

Cloudlog is a web-based amateur radio logging application. The vulnerability exists within a search endpoint of the web interface. Because this software is designed to be a web application commonly accessed over a network to manage and view logs, it is likely to be deployed in an internet-facing manner.

SQL Injection

Magicbug Cloudlog

2.6.15

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Cloudlog software, specifically affecting its search functionality. This issue could allow unauthorized access to or manipulation of data within the application.

Enables unauthorized data access or changes.
Affects web-based logging software.
Confirm relevance and exposure of Cloudlog.

Attack Path

How an attacker could exploit the issue

An attacker can target the Cloudlog web application by sending specially crafted requests to its search feature. This feature is exposed on the internet and accessible without any authentication. The vulnerability lies in how the application handles a parameter within its search endpoint. If successful, an attacker could manipulate database queries, potentially leading to unauthorized access to sensitive information or even modification of the application's data.

No authentication required.
Vulnerable search parameter.
Database compromise possible.

Live Threat

Current exploitation, exposure, and threat context

A time-based blind SQL injection vulnerability in Cloudlog's search functionality could allow an unauthenticated attacker to infer information about the underlying database. This occurs when the `qsoresults` parameter is manipulated at the `/index.php/logbookadvanced/search` endpoint, potentially leading to the disclosure of database structure or sensitive data.

Database structure and sensitive data.
Via manipulated search query parameter.
Information disclosure and unauthorized access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical SQL injection vulnerability in Cloudlog impacts application owners and potentially infrastructure or platform teams responsible for its deployment and maintenance. The first practical step is to locate all instances of Cloudlog, confirm their exposure and business criticality, and identify the specific accountable owner. This will enable a risk-based remediation plan.

Application owners should manage remediation.
Verify Cloudlog instances and exposure.
Plan and coordinate vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Cloudlog?

Cloudlog is a web-based logging application specifically designed for amateur radio operators. It helps users manage, organize, and view their radio contact logs through a centralized web interface. Because it is built as a web application, it is commonly hosted on servers where users can access their logging data over a network.

What does CVE-2024-44065 mean?

This CVE represents a security weakness classified as CWE-89, or SQL Injection. In plain terms, it means the application does not properly sanitize user input, allowing an attacker to insert malicious commands into database queries. In this specific case, it is a time-based blind injection, where an attacker identifies data by measuring how long the server takes to respond to certain queries.

How can an attacker trigger this vulnerability?

An attacker can exploit this by sending a specially crafted request to the search feature of the application, specifically targeting the 'qsoresults' parameter at the '/index.php/logbookadvanced/search' endpoint. No authentication is required to initiate this request. Simply viewing the page or performing a legitimate search without malicious input does not trigger the vulnerability.

Is my instance of Cloudlog at risk?

According to Halo Surface Signal, Cloudlog is often deployed in an internet-facing manner to allow remote access to radio logs, which increases the likelihood of exposure. If your specific instance is reachable from the internet, it is at higher risk. You should check your network configuration to determine if your application is accessible publicly or restricted to an internal network.

What should I do to secure my deployment?

Your first step is to locate all active installations of Cloudlog within your environment to understand your total footprint. Once you have an inventory, confirm which instances are internet-facing and verify who is responsible for managing them. Prioritize these findings to coordinate a remediation plan and watch for official updates from the software provider.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.