CVE-2024-6471
📋 TL;DR
This is a critical SQL injection vulnerability in SourceCodester Online Tours & Travels Management System 1.0 that allows remote attackers to execute arbitrary SQL commands via the 'uname' parameter in sms_setting.php. Attackers can potentially access, modify, or delete database content. All users running the vulnerable version are affected.
💻 Affected Systems
- SourceCodester Online Tours & Travels Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, authentication bypass, and potential server takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized database access leading to sensitive data exposure (user credentials, personal information, financial data).
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages or partial data exposure.
🎯 Exploit Status
Exploit details are publicly available; SQL injection is well-understood and easily weaponized with automated tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider: 1) Contact SourceCodester for updates 2) Apply manual fixes to sms_setting.php 3) Consider alternative software if no fix is forthcoming.
🔧 Temporary Workarounds
Input Validation and Parameterized Queries
allModify sms_setting.php to use prepared statements with parameterized queries instead of direct string concatenation.
Edit sms_setting.php to replace vulnerable SQL queries with PDO or mysqli prepared statements
Access Restriction
linuxRestrict access to sms_setting.php file via web server configuration or firewall rules.
# Apache: Add to .htaccess
<Files "sms_setting.php">
Order deny,allow
Deny from all
</Files>
# Nginx: Add to server block
location ~ /sms_setting\.php$ { deny all; }
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) with SQL injection rules
- Isolate the system in a segmented network with strict access controls
🔍 How to Verify
Check if Vulnerable:
Test the sms_setting.php endpoint with SQL injection payloads in the 'uname' parameter and observe database errors or unexpected behavior.Check Version:
Check the software version in admin panel or configuration files; look for version 1.0 in source code or documentation.Verify Fix Applied:
After applying fixes, test with the same SQL injection payloads and verify no database errors occur and input is properly sanitized.📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in web server logs
- Unusual database queries from web application
- Multiple failed login attempts or parameter manipulation
Network Indicators:
- HTTP requests to sms_setting.php with SQL keywords in parameters
- Unusual database traffic patterns from web server
SIEM Query:
web.url: *sms_setting.php AND (web.param: *OR* OR web.param: *UNION* OR web.param: *SELECT* OR web.param: *--*)🔗 References
- https://blog.csdn.net/ENTICE1208/article/details/140141934
- https://vuldb.com/?ctiid.270279
- https://vuldb.com/?id.270279
- https://vuldb.com/?submit.367953
- https://blog.csdn.net/ENTICE1208/article/details/140141934
- https://vuldb.com/?ctiid.270279
- https://vuldb.com/?id.270279
- https://vuldb.com/?submit.367953
