CVE-2024-42558
📋 TL;DR
This SQL injection vulnerability in Hotel Management System allows attackers to execute arbitrary SQL commands through the book_id parameter in admin_modify_room.php. This can lead to data theft, modification, or deletion, affecting all systems running the vulnerable commit.
💻 Affected Systems
- Hotel Management System
📦 What is this software?
Hotel Management System by Vaibhavverma9999
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including credential theft, data destruction, and potential remote code execution via database functions.
Likely Case
Unauthorized data access, modification of booking records, and potential privilege escalation to administrative access.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing SQL injection.
🎯 Exploit Status
Proof of concept available in GitHub gist, simple SQL injection payloads work.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
1. Update to latest version if available. 2. Manually patch admin_modify_room.php to use parameterized queries. 3. Validate and sanitize book_id input.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to only accept numeric values for book_id parameter
Add: if(!is_numeric($_GET['book_id'])) { die('Invalid input'); }
Web Application Firewall Rule
allBlock SQL injection patterns at the WAF level
WAF rule: Block requests containing SQL keywords like UNION, SELECT, INSERT, DELETE in book_id parameter
🧯 If You Can't Patch
- Restrict access to admin_modify_room.php using IP whitelisting or authentication
- Implement database user with minimal privileges for the application
🔍 How to Verify
Check if Vulnerable:
Test with payload: admin_modify_room.php?book_id=1' OR '1'='1Check Version:
Check git commit hash or version file if availableVerify Fix Applied:
Test with same payload - should return error or no data, not execute SQL📡 Detection & Monitoring
Log Indicators:
- SQL error messages in web logs
- Unusual database queries from web application user
- Multiple failed parameter validation attempts
Network Indicators:
- HTTP requests with SQL keywords in book_id parameter
- Unusual traffic patterns to admin_modify_room.php
SIEM Query:
source="web_logs" AND (uri="*admin_modify_room.php*" AND (param="*book_id=*'*" OR param="*book_id=*%27*" OR param="*book_id=*UNION*" OR param="*book_id=*SELECT*"))