CVE-2024-37799
📋 TL;DR
This SQL injection vulnerability in CodeProjects Restaurant Reservation System v1.0 allows attackers to manipulate database queries via the reserv_id parameter. Attackers could potentially read, modify, or delete reservation data. Any organization using this specific version of the software is affected.
💻 Affected Systems
- CodeProjects Restaurant Reservation System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data exfiltration, data manipulation, or potential authentication bypass leading to full system control.
Likely Case
Unauthorized viewing or modification of reservation data, potential exposure of customer information.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to reservation table only.
🎯 Exploit Status
SQL injection via GET parameter makes exploitation straightforward. Public proof-of-concept available in GitHub repository.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Manually fix the vulnerable code in view_reservations.php by implementing parameterized queries or input validation.
🔧 Temporary Workarounds
Input Validation Workaround
allAdd input validation to ensure reserv_id parameter contains only numeric values
Modify view_reservations.php to add: if(!is_numeric($_GET['reserv_id'])) { die('Invalid input'); }
Web Application Firewall
allDeploy WAF with SQL injection protection rules
🧯 If You Can't Patch
- Implement network segmentation to isolate the vulnerable system
- Add strict database user permissions limiting access to only necessary tables
🔍 How to Verify
Check if Vulnerable:
Test view_reservations.php with SQL injection payloads like: view_reservations.php?reserv_id=1' OR '1'='1Check Version:
Check PHP files for version information or review source code commentsVerify Fix Applied:
Test with same payloads after implementing fixes - should return error or no data instead of executing query📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts or parameter manipulation in web logs
Network Indicators:
- Unusual database connections from web server
- SQL error messages in HTTP responses
SIEM Query:
web_logs WHERE url LIKE '%view_reservations.php%' AND (parameter CONTAINS 'OR' OR parameter CONTAINS 'UNION' OR parameter CONTAINS 'SELECT')