CVE-2024-10349
📋 TL;DR
This critical SQL injection vulnerability in SourceCodester Best House Rental Management System 1.0 allows attackers to execute arbitrary SQL commands via the delete_tenant function. Attackers can remotely manipulate the 'id' parameter in /ajax.php?action=delete_tenant to potentially access, modify, or delete database content. All users running the affected version are vulnerable.
💻 Affected Systems
- SourceCodester Best House Rental Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, privilege escalation to admin access, and potential remote code execution if database functions allow it.
Likely Case
Unauthorized data access and modification of tenant records, potential extraction of sensitive information like personal data or credentials stored in the database.
If Mitigated
Limited impact with proper input validation and database permissions restricting the attack surface.
🎯 Exploit Status
Public exploit details are available on GitHub. SQL injection vulnerabilities are commonly weaponized with automated tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available, or implement workarounds.
🔧 Temporary Workarounds
Input Validation and Parameterized Queries
allModify the delete_tenant function to use prepared statements with parameterized queries instead of concatenating user input.
Edit /ajax.php to replace vulnerable SQL with prepared statements using PDO or mysqli
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection protection rules to block malicious requests.
🧯 If You Can't Patch
- Isolate the system from the internet and restrict access to authorized users only
- Implement strict database permissions limiting the application user to only necessary operations
🔍 How to Verify
Check if Vulnerable:
Test the /ajax.php?action=delete_tenant endpoint with SQL injection payloads in the 'id' parameter and observe database errors or unexpected behavior.Check Version:
Check the system version in the admin panel or configuration files, typically in config.php or similar.Verify Fix Applied:
After implementing parameterized queries, test with SQL injection payloads to confirm they are properly sanitized and no longer execute.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple DELETE requests with suspicious 'id' parameters
- Requests to /ajax.php?action=delete_tenant with SQL keywords in parameters
Network Indicators:
- HTTP requests containing SQL injection patterns (UNION, SELECT, etc.) in URL parameters
- Unusual database query patterns from the application server
SIEM Query:
source="web_logs" AND (url="*ajax.php*action=delete_tenant*" AND (param="*UNION*" OR param="*SELECT*" OR param="*OR 1=1*"))