CVE-2024-5364
📋 TL;DR
This critical SQL injection vulnerability in SourceCodester Best House Rental Management System allows attackers to execute arbitrary SQL commands via the 'id' parameter in manage_tenant.php. Attackers can potentially access, modify, or delete database contents, including sensitive tenant information. All users running versions up to 1.0 are affected.
💻 Affected Systems
- SourceCodester Best House Rental Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chaining
Likely Case
Unauthorized access to sensitive tenant data (personal information, payment details), database manipulation, or privilege escalation
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permissions restricting damage scope
🎯 Exploit Status
Public exploit code available on GitHub; SQL injection via simple parameter manipulation requires minimal technical skill
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider: 1) Replace vulnerable manage_tenant.php with secure version implementing parameterized queries, 2) Apply input validation/sanitization to 'id' parameter, 3) Consider migrating to alternative software if vendor doesn't provide fix
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns targeting manage_tenant.php
# Example ModSecurity rule: SecRule ARGS:id "@detectSQLi" "id:1001,phase:2,deny,status:403,msg:'SQLi attempt detected'"
Input Validation Filter
allAdd input validation to only accept numeric values for the 'id' parameter
<?php
// Add to manage_tenant.php before processing
if (!is_numeric($_GET['id']) || $_GET['id'] <= 0) {
http_response_code(400);
exit('Invalid ID parameter');
}
?>
🧯 If You Can't Patch
- Isolate the system behind strict network segmentation and limit database access to only necessary services
- Implement database-level controls: use least privilege accounts, enable query logging, and restrict database user permissions
🔍 How to Verify
Check if Vulnerable:
Test by accessing manage_tenant.php?id=1' OR '1'='1 and observing if SQL error occurs or unexpected behaviorCheck Version:
Check PHP files for version comments or review installation documentation; typically no built-in version commandVerify Fix Applied:
Attempt SQL injection tests after applying fixes; verify no SQL errors or data leakage occurs with malicious payloads📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple rapid requests to manage_tenant.php with varying id parameters
- Database queries containing SQL keywords from web input
Network Indicators:
- HTTP requests to manage_tenant.php with SQL injection payloads in parameters
- Unusual database traffic patterns from web server
SIEM Query:
source="web_logs" AND uri="/manage_tenant.php" AND (param="id" AND value MATCH "[';]|OR|UNION|SELECT")🔗 References
- https://github.com/rockersiyuan/CVE/blob/main/SourceCodester_House_Rental_Management_System_Sql_Inject-2.md
- https://vuldb.com/?ctiid.266276
- https://vuldb.com/?id.266276
- https://vuldb.com/?submit.343431
- https://github.com/rockersiyuan/CVE/blob/main/SourceCodester_House_Rental_Management_System_Sql_Inject-2.md
- https://vuldb.com/?ctiid.266276
- https://vuldb.com/?id.266276
- https://vuldb.com/?submit.343431
