CVE-2024-6112
📋 TL;DR
A critical SQL injection vulnerability in itsourcecode Pool of Bethesda Online Reservation System 1.0 allows remote attackers to execute arbitrary SQL commands via the log_email parameter in index.php. This can lead to unauthorized data access, modification, or deletion. All deployments of version 1.0 are affected.
💻 Affected Systems
- itsourcecode Pool of Bethesda Online Reservation System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, and potential remote code execution if database functions allow it.
Likely Case
Unauthorized access to sensitive reservation data, user information, and potential privilege escalation.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage scope.
🎯 Exploit Status
Public exploit available on GitHub. SQL injection via log_email parameter requires minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing custom fixes.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize log_email parameter before SQL processing
Modify index.php to add parameter validation: $log_email = mysqli_real_escape_string($connection, $_POST['log_email']);
Web Application Firewall
allDeploy WAF with SQL injection protection rules
🧯 If You Can't Patch
- Isolate the system behind a firewall with strict access controls
- Implement database user with minimal privileges (read-only if possible)
🔍 How to Verify
Check if Vulnerable:
Test index.php with SQL injection payloads in log_email parameter: ' OR '1'='1Check Version:
Check application files for version information or documentationVerify Fix Applied:
Test with same payloads after implementing fixes - should return error or no data📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts with SQL syntax
Network Indicators:
- HTTP POST requests to index.php with SQL keywords in parameters
SIEM Query:
source="web_logs" AND uri="*index.php*" AND (param="*log_email*" AND value="*OR*" OR value="*UNION*" OR value="*SELECT*" OR value="*--*" OR value="*'*'*'")