CVE-2023-50864
📋 TL;DR
Travel Website v1.0 contains unauthenticated SQL injection vulnerabilities in the hotelDetails.php resource, allowing attackers to execute arbitrary SQL commands without authentication. This affects all deployments of Travel Website v1.0 that expose the vulnerable endpoint.
💻 Affected Systems
- Travel Website
📦 What is this software?
Travel Website by Kashipara
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, authentication bypass, and potential remote code execution via database functions.
Likely Case
Database information disclosure, session hijacking, and potential privilege escalation leading to unauthorized access to sensitive user data.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages or partial data exposure.
🎯 Exploit Status
SQL injection via hotelId parameter requires no authentication and can be exploited with basic SQL injection techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.kashipara.com/
Restart Required: No
Instructions:
1. Check vendor website for updated version
2. Replace vulnerable hotelDetails.php file
3. Test functionality after update
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to only accept numeric values for hotelId parameter
Modify hotelDetails.php to include: if(!is_numeric($_GET['hotelId'])) { die('Invalid input'); }
Web Application Firewall
allDeploy WAF with SQL injection protection rules
🧯 If You Can't Patch
- Block external access to hotelDetails.php endpoint at network perimeter
- Implement database user with minimal permissions (read-only if possible)
🔍 How to Verify
Check if Vulnerable:
Test hotelDetails.php?hotelId=1' OR '1'='1 and observe database errors or unexpected behaviorCheck Version:
Check Travel Website version in admin panel or configuration filesVerify Fix Applied:
Test same payload after fix and confirm proper error handling or rejection📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in web server logs
- Multiple rapid requests to hotelDetails.php with unusual parameters
Network Indicators:
- HTTP requests containing SQL keywords (SELECT, UNION, etc.) in hotelId parameter
SIEM Query:
source="web_logs" AND uri="*hotelDetails.php*" AND (query="*' OR*" OR query="*UNION*" OR query="*SELECT*" OR query="*--*" OR query="*;*" OR query="*/*")