CVE-2024-11860
📋 TL;DR
This critical vulnerability in SourceCodester Best House Rental Management System 1.0 allows unauthorized deletion of tenant records via a POST request to /rental/ajax.php with manipulated 'id' parameter. Attackers can exploit this remotely without proper authentication. All deployments of version 1.0 are affected.
💻 Affected Systems
- SourceCodester Best House Rental Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete tenant database compromise with mass deletion of tenant records, disrupting rental operations and causing data loss.
Likely Case
Targeted deletion of specific tenant records by attackers, leading to operational disruption and potential data integrity issues.
If Mitigated
Unauthorized access attempts logged and blocked with proper authorization controls in place.
🎯 Exploit Status
Exploit details are publicly available on GitHub and require only HTTP POST request manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available or implementing workarounds.
🔧 Temporary Workarounds
Web Application Firewall Rule
allBlock or monitor POST requests to /rental/ajax.php with action=delete_tenant
WAF-specific configuration required
File Access Restriction
linuxRestrict access to ajax.php or implement proper authentication checks
chmod 600 /path/to/rental/ajax.php
Add authentication check at top of ajax.php
🧯 If You Can't Patch
- Implement strong authentication and authorization checks before processing delete_tenant actions
- Deploy the system behind a reverse proxy with request validation and rate limiting
🔍 How to Verify
Check if Vulnerable:
Test if POST request to /rental/ajax.php?action=delete_tenant with arbitrary id parameter succeeds without proper authenticationCheck Version:
Check application version in admin panel or configuration filesVerify Fix Applied:
Verify that unauthorized POST requests to delete_tenant endpoint are rejected with proper error messages📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /rental/ajax.php with action=delete_tenant
- Unauthorized access attempts to tenant deletion endpoint
Network Indicators:
- HTTP POST requests to /rental/ajax.php with delete_tenant action from unexpected sources
SIEM Query:
source="web_server" AND uri="/rental/ajax.php" AND method="POST" AND params.action="delete_tenant"🔗 References
- https://drive.google.com/file/d/1CyjtknGVqn5QO_R1WZX-hoGH8ae5DjRq/view
- https://github.com/YasserREED/YasserREED-CVEs/blob/main/Best%20house%20rental%20management%20system%20project%20in%20php/Unauthorized%20Tenant%20Deletion.md
- https://vuldb.com/?ctiid.286245
- https://vuldb.com/?id.286245
- https://vuldb.com/?submit.449684
- https://www.sourcecodester.com/
