CVE-2024-2590: High SQL Injection in AMSS++ 4.31

CVE-2024-2590 is a SQL injection in AMSS++ version 4.31, reachable at /amssplus/modules/mail/main/select_send.php through the sd_index parameter. Severity is High at 8.2. No fixed version is named in the record, so check the INCIBE notice and the vendor. The sections below cover affected versions, checks and next steps.

What's affected

• AMSS++ 4.31 is the only version the record lists.
• The vulnerable endpoint is /amssplus/modules/mail/main/select_send.php in the mail module.
• No fixed version is named in the NVD record. Check the vendor or the advisory linked in Sources before assuming a patch exists.

The NVD record gives a CVSS score of 8.2 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. Published 2024-03-18.

How to check if you're exposed

1. Confirm whether AMSS++ is deployed anywhere in your estate and which version it reports.
2. Search your web server logs for requests to the affected file. For Apache the access log is often at /var/log/apache2/access.log and the search is grep -F "select_send.php" /var/log/apache2/access.log; adjust the path for your server.
3. Review requests that carry unusually long or odd parameter values, and check database logs for errors from malformed queries.
4. Read the INCIBE notice named in Sources for any version or mitigation guidance.

What to do now

1. Inventory every AMSS++ instance and note the version.
2. Ask the vendor or check the INCIBE notice for a patched release, and apply it when one is confirmed.
3. Until then, remove the application from the public internet or put it behind a VPN or an IP allow list.
4. Make sure the database account used by the application has the least privilege it needs, and that it cannot read tables unrelated to the app.
5. Review database and web logs for the affected path and rotate any credentials stored in the database if you see suspicious access.

If this software reaches you as part of something you build, the free in-browser dependency scan at gold.safeguard.sh/scan lists known vulnerabilities in your manifests, and reachability analysis helps you see which ones your code can actually trigger.

Why it matters

The record says a remote attacker without credentials could send a crafted query and retrieve all the information stored in the database. That is why the confidentiality impact is rated high while integrity impact is low and availability impact is none in the CVSS vector.

The record tags the weakness as CWE-89. See the Gold pages for more on the class.

SQL injection happens when input from a request is placed into a database query without being kept separate from the query itself. The database then treats part of the input as instructions. The usual defence is parameterised queries, plus a database account that can only do what the application needs.

The record's Known Exploited Vulnerabilities flag is false, so CISA has not listed it as exploited.

Three SQL injection flaws in AMSS++ 4.31 were published on the same day, CVE-2024-2590, CVE-2024-2591 and CVE-2024-2592, each in a different file. A file upload flaw, CVE-2024-2599, was published in the same notice. If you find one of them, treat the others as present too, because they come from the same version of the same application.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• INCIBE-CERT notice on multiple vulnerabilities in AMSS++

I did not retrieve the pages above when preparing this post, either because they blocked automated access or because I relied on the NVD record. The details here come from that record, so read the linked reference for the original wording.

Last reviewed: 19 October 2026.