CVE-2024-10159
📋 TL;DR
This critical SQL injection vulnerability in PHPGurukul Boat Booking System 1.0 allows attackers to manipulate database queries through the profile.php page. Remote attackers can potentially access, modify, or delete sensitive data in the database. All installations of version 1.0 with the vulnerable component exposed are affected.
💻 Affected Systems
- PHPGurukul Boat Booking System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, authentication bypass, privilege escalation, and potential remote code execution via database functions.
Likely Case
Unauthorized access to sensitive user data, administrative credentials theft, and potential system takeover through SQL injection.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
Exploit requires authentication to access /admin/profile.php. Public proof-of-concept available on GitHub.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://phpgurukul.com/
Restart Required: No
Instructions:
No official patch available. Implement parameterized queries and input validation in /admin/profile.php. Replace raw SQL queries with prepared statements.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd server-side validation for all user inputs in profile.php parameters
Web Application Firewall Rules
allImplement WAF rules to block SQL injection patterns targeting /admin/profile.php
🧯 If You Can't Patch
- Restrict access to /admin/ directory to trusted IP addresses only
- Disable or remove the Boat Booking System if not essential
🔍 How to Verify
Check if Vulnerable:
Test /admin/profile.php with SQL injection payloads in sadminusername, fullname, emailid, or mobilenumber parametersCheck Version:
Check system documentation or configuration files for version informationVerify Fix Applied:
Verify that parameterized queries are implemented and SQL injection attempts return errors instead of executing📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in application logs
- Multiple failed login attempts to /admin/
- Database error messages containing SQL syntax
Network Indicators:
- HTTP POST requests to /admin/profile.php with SQL keywords in parameters
- Unusual database connection patterns
SIEM Query:
source="web_logs" AND uri="/admin/profile.php" AND (param="sadminusername" OR param="fullname" OR param="emailid" OR param="mobilenumber") AND (content="UNION" OR content="SELECT" OR content="INSERT" OR content="DELETE")