CVE-2024-5094
📋 TL;DR
This critical SQL injection vulnerability in SourceCodester Best House Rental Management System 1.0 allows remote attackers to manipulate database queries through the 'id' parameter in view_payment.php. Attackers can potentially read, modify, or delete database contents, including sensitive rental and payment information. All users running the affected version are vulnerable.
💻 Affected Systems
- SourceCodester Best House Rental Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, authentication bypass, and potential remote code execution via database functions.
Likely Case
Unauthorized access to sensitive rental data, payment information, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permissions restricting damage to non-critical data.
🎯 Exploit Status
Public exploit code is available on GitHub; SQL injection via 'id' parameter requires minimal technical skill to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
1. Check SourceCodester website for updates 2. If patch available, download and replace affected files 3. Test functionality after patching
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to ensure 'id' parameter contains only numeric values
In view_payment.php, add: if(!is_numeric($_GET['id'])) { die('Invalid input'); }
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns
ModSecurity rule: SecRule ARGS:id "@detectSQLi" "id:1001,phase:2,deny,status:403"
🧯 If You Can't Patch
- Isolate the system behind a reverse proxy with strict input validation
- Implement database-level controls: restrict application database user permissions to SELECT only
🔍 How to Verify
Check if Vulnerable:
Test view_payment.php with SQL injection payloads in 'id' parameter: view_payment.php?id=1' OR '1'='1Check Version:
Check application files for version markers or review source code commentsVerify Fix Applied:
Test with same payloads; application should reject invalid input or return error without database interaction📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple requests to view_payment.php with special characters in parameters
- Database queries with UNION, SELECT, or other SQL keywords from unexpected sources
Network Indicators:
- HTTP requests with SQL injection patterns in 'id' parameter
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND uri="*view_payment.php*" AND (param="*id=*'*" OR param="*id=*%27*" OR param="*id=*UNION*" OR param="*id=*SELECT*")🔗 References
- https://github.com/BurakSevben/CVEs/blob/main/House%20Rental%20Management%20System/House%20Rental%20Management%20System%20-%20SQL%20Injection%20-%202.md
- https://vuldb.com/?ctiid.265073
- https://vuldb.com/?id.265073
- https://vuldb.com/?submit.335714
- https://github.com/BurakSevben/CVEs/blob/main/House%20Rental%20Management%20System/House%20Rental%20Management%20System%20-%20SQL%20Injection%20-%202.md
- https://vuldb.com/?ctiid.265073
- https://vuldb.com/?id.265073
- https://vuldb.com/?submit.335714
