CVE-2024-3356
📋 TL;DR
This is a critical SQL injection vulnerability in SourceCodester Aplaya Beach Resort Online Reservation System 1.0. Attackers can remotely exploit the admin/mod_settings/controller.php?action=add endpoint by manipulating the 'type' parameter to execute arbitrary SQL commands. All deployments of this specific software version are affected.
💻 Affected Systems
- SourceCodester Aplaya Beach Resort Online Reservation System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, authentication bypass, and potential remote code execution via database functions.
Likely Case
Unauthorized access to sensitive reservation data, customer PII exposure, and potential administrative account takeover.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permission restrictions in place.
🎯 Exploit Status
Exploit code is publicly available on GitHub. Attack requires access to admin interface but may be combined with other vulnerabilities.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing custom fixes with parameterized queries.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize the 'type' parameter before processing
Add PHP validation: if(!preg_match('/^[a-zA-Z0-9_]+$/', $_GET['type'])) { die('Invalid input'); }
WAF Rule Implementation
allBlock SQL injection patterns targeting the vulnerable endpoint
WAF rule: deny requests to */admin/mod_settings/controller.php?action=add* containing SQL keywords
🧯 If You Can't Patch
- Isolate the system behind a firewall with strict access controls
- Implement database-level protections: restrict application database user permissions
🔍 How to Verify
Check if Vulnerable:
Test the endpoint with SQL injection payloads: /admin/mod_settings/controller.php?action=add&type=1' OR '1'='1Check Version:
Check software version in admin panel or readme filesVerify Fix Applied:
Test with same payloads and verify proper error handling or rejection📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple failed login attempts followed by admin access
- Requests to vulnerable endpoint with SQL keywords
Network Indicators:
- HTTP requests containing SQL injection patterns to the vulnerable URL
- Unusual database query patterns from application server
SIEM Query:
source="web_logs" AND url="*controller.php?action=add*" AND (query="*UNION*" OR query="*SELECT*" OR query="*OR '1'='1*")🔗 References
- https://github.com/qqqyc/vlun1/blob/main/Aplaya-Beach-Resort-Online-Reservation-System-10
- https://vuldb.com/?ctiid.259460
- https://vuldb.com/?id.259460
- https://vuldb.com/?submit.310225
- https://github.com/qqqyc/vlun1/blob/main/Aplaya-Beach-Resort-Online-Reservation-System-10
- https://vuldb.com/?ctiid.259460
- https://vuldb.com/?id.259460
- https://vuldb.com/?submit.310225
