CVE-2024-10153
📋 TL;DR
This vulnerability allows remote attackers to execute SQL injection attacks on PHPGurukul Boat Booking System 1.0 by manipulating bookingdatefrom/nopeople parameters in the book-boat.php file. Successful exploitation could lead to unauthorized database access, data theft, or system compromise. Organizations using this specific booking system version are affected.
💻 Affected Systems
- PHPGurukul Boat Booking System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise allowing data exfiltration, privilege escalation, or remote code execution on the underlying server.
Likely Case
Unauthorized access to booking data, user information, and potential manipulation of booking records.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-sensitive data.
🎯 Exploit Status
Public exploit available on GitHub. Remote exploitation requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://phpgurukul.com/
Restart Required: No
Instructions:
No official patch available. Consider implementing input validation and parameterized queries as workaround.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation for bookingdatefrom and nopeople parameters to prevent SQL injection.
Modify book-boat.php to validate and sanitize user inputs before database queries
Web Application Firewall Rules
allDeploy WAF rules to block SQL injection patterns targeting book-boat.php parameters.
Configure WAF to detect and block SQL injection attempts on bookingdatefrom/nopeople parameters
🧯 If You Can't Patch
- Isolate the booking system from critical networks and databases
- Implement strict network segmentation and monitor all traffic to book-boat.php
🔍 How to Verify
Check if Vulnerable:
Test book-boat.php?bid=1 with SQL injection payloads in bookingdatefrom or nopeople parametersCheck Version:
Check system documentation or source code for version informationVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and return proper error handling📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts following SQL injection patterns
- HTTP requests with SQL keywords to book-boat.php
Network Indicators:
- Unusual outbound database connections
- SQL error messages in HTTP responses
SIEM Query:
source="web_logs" AND uri="*book-boat.php*" AND (query="*SELECT*" OR query="*UNION*" OR query="*OR 1=1*")