CVE-2017-17584
📋 TL;DR
CVE-2017-17584 is a critical SQL injection vulnerability in FS Makemytrip Clone 1.0 travel booking software. Attackers can inject malicious SQL queries through the fl_orig or fl_dest parameters in show-flight-result.php, potentially allowing database compromise. Any organization using this specific software version is affected.
💻 Affected Systems
- FS Makemytrip Clone
📦 What is this software?
Makemytrip Clone by Makemytrip Clone Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, authentication bypass, and potential remote code execution via database functions.
Likely Case
Database information disclosure including user credentials, personal data, and booking information leading to data breach.
If Mitigated
Limited impact with proper input validation and database permissions restricting unauthorized access.
🎯 Exploit Status
Multiple public exploit scripts available. Attack requires no authentication and uses simple SQL injection techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No official vendor advisory found
Restart Required: No
Instructions:
No official patch available. Consider replacing with secure alternative software or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd parameter validation and sanitization to show-flight-result.php to prevent SQL injection
Modify PHP code to use prepared statements with parameterized queries
Implement input validation for fl_orig and fl_dest parameters
Web Application Firewall Rules
allDeploy WAF rules to block SQL injection patterns in the vulnerable parameters
Add WAF rule: Detect SQL injection patterns in fl_orig and fl_dest parameters
Block requests containing SQL keywords in these parameters
🧯 If You Can't Patch
- Isolate the vulnerable system behind a reverse proxy with strict input filtering
- Implement network segmentation to limit database access from the vulnerable application
🔍 How to Verify
Check if Vulnerable:
Test show-flight-result.php with SQL injection payloads in fl_orig or fl_dest parameters (e.g., ' OR '1'='1)Check Version:
Check PHP files for version references or consult installation documentationVerify Fix Applied:
Test with same SQL injection payloads after implementing fixes - should return error or no data disclosure📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple requests with SQL keywords in fl_orig/fl_dest parameters
- Database error logs showing injection attempts
Network Indicators:
- HTTP requests containing SQL injection patterns in parameters
- Unusual database query patterns from application server
SIEM Query:
web.url:*show-flight-result.php* AND (web.param:*fl_orig* OR web.param:*fl_dest*) AND (web.param:*OR* OR web.param:*UNION* OR web.param:*SELECT*)