CVE-2024-10156
📋 TL;DR
This critical SQL injection vulnerability in PHPGurukul Boat Booking System 1.0 allows attackers to execute arbitrary SQL commands via the username parameter on the admin sign-in page. Attackers can potentially access, modify, or delete database content, including sensitive booking information and admin credentials. All installations of version 1.0 with the vulnerable component exposed are affected.
💻 Affected Systems
- PHPGurukul Boat Booking System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, admin credential disclosure, system takeover, and potential lateral movement to connected systems.
Likely Case
Unauthorized access to booking data, customer information exposure, and potential privilege escalation to admin accounts.
If Mitigated
Limited impact if proper input validation and WAF rules block malicious payloads, though underlying vulnerability remains.
🎯 Exploit Status
Public exploit code is available, making this easily exploitable by attackers with basic SQL injection knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://phpgurukul.com/
Restart Required: No
Instructions:
No official patch available. Consider implementing parameterized queries or input validation in /admin/index.php, or migrate to a different booking system.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd server-side validation to sanitize username input before SQL processing
Edit /admin/index.php to add: $username = mysqli_real_escape_string($connection, $_POST['username']);
Web Application Firewall Rules
allImplement WAF rules to block SQL injection patterns targeting the admin sign-in page
Add WAF rule: Detect and block requests containing SQL keywords like UNION, SELECT, INSERT targeting /admin/index.php
🧯 If You Can't Patch
- Restrict access to /admin/ directory using IP whitelisting or VPN-only access
- Implement rate limiting and monitoring on the admin sign-in page for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Test the admin sign-in page with SQL injection payloads like: admin' OR '1'='1Check Version:
Check system documentation or contact vendor to confirm version 1.0 is installedVerify Fix Applied:
Attempt SQL injection tests after implementing fixes; successful login should only occur with valid credentials📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts with SQL keywords in username field
- Unusual database queries from admin interface
Network Indicators:
- HTTP POST requests to /admin/index.php containing SQL injection patterns
SIEM Query:
source="web_logs" AND uri="/admin/index.php" AND (username CONTAINS "UNION" OR username CONTAINS "SELECT" OR username CONTAINS "--")