CVE-2024-10411
📋 TL;DR
This is a critical SQL injection vulnerability in SourceCodester Online Hotel Reservation System 1.0 that allows remote attackers to execute arbitrary SQL commands through manipulated 'id' parameters in multiple admin functions. Attackers can potentially access, modify, or delete database content including sensitive guest information and system credentials. All deployments of version 1.0 are affected.
💻 Affected Systems
- SourceCodester Online Hotel Reservation System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to guest data theft, reservation manipulation, administrative account takeover, and potential server compromise via SQL command execution.
Likely Case
Unauthorized access to sensitive guest information (PII), reservation data manipulation, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only allowing data viewing without modification.
🎯 Exploit Status
Exploit requires admin access or ability to reach admin endpoints. Public proof-of-concept available on GitHub.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Consider implementing input validation and parameterized queries in /marimar/admin/mod_room/controller.php functions.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation for all 'id' parameters in affected functions to prevent SQL injection.
Modify controller.php to validate and sanitize user inputs before database queries
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns targeting the vulnerable endpoints.
Configure WAF to block requests containing SQL injection patterns to /marimar/admin/mod_room/controller.php
🧯 If You Can't Patch
- Isolate the system behind a firewall with strict access controls
- Implement database-level protections: use least privilege accounts, enable query logging
🔍 How to Verify
Check if Vulnerable:
Test the affected endpoints (/marimar/admin/mod_room/controller.php) with SQL injection payloads in the 'id' parameterCheck Version:
Check system version in admin panel or configuration filesVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and that parameterized queries are implemented📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts to admin interface
- Requests to controller.php with SQL keywords in parameters
Network Indicators:
- HTTP requests containing SQL injection patterns to vulnerable endpoints
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND (url="/marimar/admin/mod_room/controller.php" AND (param="id" AND value CONTAINS "' OR" OR value CONTAINS "UNION" OR value CONTAINS "SELECT"))