CVE-2024-51030
📋 TL;DR
A SQL injection vulnerability in Sourcecodester Cab Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in manage_client.php and view_cab.php files. This can lead to unauthorized database access, data theft, or system compromise. Organizations using this specific version of the software are affected.
💻 Affected Systems
- Sourcecodester Cab Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including theft of sensitive customer data, financial records, and administrative credentials, potentially leading to full system takeover.
Likely Case
Unauthorized access to database contents including customer information, trip records, and potentially administrative credentials.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-sensitive data.
🎯 Exploit Status
Public exploit code available on GitHub; SQL injection via URL parameter is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Replace vulnerable files with sanitized versions or implement input validation.
🔧 Temporary Workarounds
Input Validation Implementation
allAdd parameter validation to ensure id parameter contains only numeric values
Edit manage_client.php and view_cab.php to add: if(!is_numeric($_GET['id'])) { die('Invalid input'); }
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns
Add WAF rule: SecRule ARGS:id "@rx (?i)(union|select|insert|update|delete|drop|create|alter)" "id:1001,phase:2,deny"
🧯 If You Can't Patch
- Isolate the system from internet access and restrict to internal network only
- Implement strict database permissions limiting application user to read-only access where possible
🔍 How to Verify
Check if Vulnerable:
Test by appending SQL injection payload to id parameter: /manage_client.php?id=1' OR '1'='1Check Version:
Check PHP files for version information or consult installation documentationVerify Fix Applied:
Test with same payload; system should reject or sanitize input without executing SQL📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts from single IP
- Requests with SQL keywords in URL parameters
Network Indicators:
- HTTP requests containing SQL injection patterns in id parameter
- Unusual database connection patterns
SIEM Query:
source="web_logs" AND (url="*manage_client.php*" OR url="*view_cab.php*") AND (url="*union*" OR url="*select*" OR url="*' OR '*")