CVE-2024-2584: High SQL Injection in AMSS++ 4.31

CVE-2024-2584 is a high severity (CVSS 8.2) SQL injection in AMSS++ version 4.31. The /amssplus/modules/book/main/select_send.php script builds a query from the sd_index parameter. The record names no fixed version, so check the INCIBE notice and contact the project. The sections below cover how to check your exposure and what to do.

What's affected

AMSS++ version 4.31, per the record's CPE data. The vulnerable file is /amssplus/modules/book/main/select_send.php, through the sd_index parameter. The record says a remote attacker can send a crafted SQL query and retrieve all information stored in the database. It is one of several AMSS++ issues in a single INCIBE CERT notice covering CVE-2024-2584 to CVE-2024-2589.

The NVD record scores it 8.2 (high) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, published 2024-03-18. The weakness is classed as CWE-89 (SQL injection).

The record names no fixed version. Its only reference is the INCIBE CERT notice on multiple AMSS++ vulnerabilities, which I could not load because the site rejected the request. Read that notice for the vendor response and any fixed version.

How to check if you're exposed

This is source code you deploy, so start with the version. Check the version file, the release tag or the download you used, and confirm whether it is AMSS++ 4.31.

Then look for the vulnerable file in your web root:

find /var/www -name 'select_send.php' 2>/dev/null

If the file exists on a server that anyone other than you can reach, assume it is exposed. Web server logs for the file name can show who has requested it.

What to do now

1. Find every AMSS++ instance and confirm it is version 4.31.
2. Read the INCIBE CERT notice for fix and mitigation details.
3. Take the application off untrusted networks until it is fixed.
4. Patch all six files named in the notice, not just one, using parameterised queries.
5. Rotate credentials stored in the database if you suspect it was queried, and review logs for the file.

Why it matters

The weakness is SQL injection. Input from the request is placed into a database query without being separated from the query structure, so a crafted value can change what the query does. Depending on the table and the database account, that means reading rows the user was never meant to see, changing records, or in some setups going further.

The reliable fix is the same in every language: parameterised queries, a database account with only the rights the page needs, and server-side validation of types. Filtering bad characters by hand tends to fail. If you run the application and no patched release exists, treat its code as something you must change yourself or take off the network.

This CVE is not on the CISA Known Exploited Vulnerabilities list (the record's KEV flag is false). Exploit details are not repeated here, because this guide is about defence.

Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan lists the open source packages in a project and flags known vulnerabilities, and the Gold directory tracks this CVE. Reachability analysis helps decide which findings in your own code actually matter.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• INCIBE CERT notice on multiple AMSS++ vulnerabilities (referenced by the record, could not be loaded)
• NVD record for CVE-2024-2584

Last reviewed: 19 October 2026.