CVE-2024-12357
📋 TL;DR
This vulnerability allows remote attackers to perform file inclusion attacks via the 'page' parameter in /index.php in SourceCodester Best House Rental Management System 1.0. Attackers can potentially read sensitive files or execute code on affected systems. All users running version 1.0 of this software are affected.
💻 Affected Systems
- SourceCodester Best House Rental Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Sensitive file disclosure (configuration files, database credentials) and limited file system access.
If Mitigated
Limited impact with proper file permissions and web server hardening, potentially only file reading.
🎯 Exploit Status
Exploit code is publicly available on Pastebin, making attacks easy to automate.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Consider workarounds or replacing the software.
🔧 Temporary Workarounds
Input Validation for Page Parameter
allAdd strict validation to only allow specific page values in /index.php
Edit /index.php to validate the 'page' parameter against a whitelist of allowed values
Web Application Firewall Rule
allBlock requests with suspicious file paths in the page parameter
Add WAF rule to block patterns like '../', '..\\', 'php://', 'file://' in URL parameters
🧯 If You Can't Patch
- Remove the system from internet-facing networks immediately
- Implement strict network segmentation and access controls
🔍 How to Verify
Check if Vulnerable:
Test if /index.php?page=../../../../etc/passwd returns system files (ethical testing only)Check Version:
Check software version in admin panel or configuration filesVerify Fix Applied:
Verify that file inclusion attempts no longer work and return error pages📡 Detection & Monitoring
Log Indicators:
- Multiple requests to /index.php with suspicious 'page' parameter values containing path traversal sequences
Network Indicators:
- HTTP requests with parameters like 'page=../../../' or 'page=php://'
SIEM Query:
web.url:*index.php* AND web.param.page:*../* OR web.param.page:*..\\* OR web.param.page:*://*