CVE-2024-10163
📋 TL;DR
This critical SQL injection vulnerability in SourceCodester Sentiment Based Movie Rating System 1.0 allows attackers to manipulate database queries through the 'id' parameter in movie_details.php. Remote attackers can potentially access, modify, or delete database content. All deployments of this specific movie rating system version are affected.
💻 Affected Systems
- SourceCodester Sentiment Based Movie Rating System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, authentication bypass, and potential server takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized data access and extraction of sensitive information from the movie rating database, potentially including user credentials and personal data.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only allowing data viewing without modification.
🎯 Exploit Status
Public exploit available on GitHub. SQL injection via URL parameter manipulation requires minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Consider removing the system or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Parameterized Queries
allModify movie_details.php to validate and sanitize the 'id' parameter using prepared statements
Edit /msrps/movie_details.php to replace raw SQL with PDO or mysqli prepared statements
Web Application Firewall (WAF) Rules
allDeploy WAF rules to block SQL injection patterns targeting the movie_details.php endpoint
Add WAF rule: deny requests to /msrps/movie_details.php with SQL injection patterns in parameters
🧯 If You Can't Patch
- Remove or restrict access to /msrps/movie_details.php via web server configuration
- Implement network segmentation to isolate the vulnerable system from sensitive databases
🔍 How to Verify
Check if Vulnerable:
Test by accessing /msrps/movie_details.php?id=1' OR '1'='1 and checking for SQL errors or unexpected behaviorCheck Version:
Check PHP files for version comments or review installation documentationVerify Fix Applied:
Test the same SQL injection attempts after fixes; they should return proper error handling or no data📡 Detection & Monitoring
Log Indicators:
- Multiple requests to movie_details.php with SQL keywords in parameters
- Database error logs showing SQL syntax errors
Network Indicators:
- HTTP requests containing SQL injection patterns targeting the id parameter
SIEM Query:
source="web_logs" AND uri="/msrps/movie_details.php" AND (query="*OR*" OR query="*UNION*" OR query="*SELECT*" OR query="*'*" OR query="*--*" OR query="*;*")