CVE-2024-12949
📋 TL;DR
This critical SQL injection vulnerability in Travel Management System 1.0 allows remote attackers to manipulate database queries via the subcatid parameter in /package.php. Attackers can potentially read, modify, or delete database contents. All users running the vulnerable version are affected.
💻 Affected Systems
- Travel Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to remote code execution.
Likely Case
Unauthorized data access, data manipulation, or authentication bypass leading to privilege escalation.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages or partial data exposure.
🎯 Exploit Status
Exploit has been publicly disclosed and SQL injection vulnerabilities are commonly weaponized.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
1. Check vendor website for updates. 2. If no patch available, implement workarounds. 3. Consider replacing with alternative software.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd parameter validation and sanitization for subcatid parameter in /package.php
Edit /package.php to add: $subcatid = mysqli_real_escape_string($connection, $_GET['subcatid']);
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns
Add WAF rule: SecRule ARGS:subcatid "@detectSQLi" "id:1001,phase:2,deny"
🧯 If You Can't Patch
- Restrict access to /package.php via network controls or authentication
- Implement database user with minimal privileges for the application
🔍 How to Verify
Check if Vulnerable:
Test /package.php?subcatid=1' OR '1'='1 and observe if SQL error or unexpected behavior occursCheck Version:
Check source code or documentation for version informationVerify Fix Applied:
Test with same payload and verify proper error handling or rejection occurs📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple requests to /package.php with SQL-like patterns in parameters
Network Indicators:
- HTTP requests to /package.php containing SQL keywords in subcatid parameter
SIEM Query:
source="web_logs" AND uri_path="/package.php" AND (query_string="*subcatid*'*" OR query_string="*subcatid*%27*")