CVE-2024-6745
📋 TL;DR
This critical SQL injection vulnerability in Simple Ticket Booking 1.0 allows attackers to execute arbitrary SQL commands through the login form's email/password fields. Remote attackers can potentially bypass authentication, access or modify database contents, and compromise the entire application. All installations of Simple Ticket Booking 1.0 with the vulnerable adminauthenticate.php file are affected.
💻 Affected Systems
- Simple Ticket Booking
📦 What is this software?
Simple Ticket Booking by Code Projects
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, authentication bypass, privilege escalation, and potential remote code execution via database functions.
Likely Case
Authentication bypass allowing unauthorized admin access, data exfiltration of user information and booking data, and potential database manipulation.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing SQL injection, though other vulnerabilities might still exist.
🎯 Exploit Status
Exploit details are publicly available on GitHub. SQL injection through login fields is straightforward for attackers with basic SQL knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Replace adminauthenticate.php with secure version using parameterized queries or prepared statements. Consider migrating to supported software.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd server-side validation and sanitization for email and password inputs before SQL processing.
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns in login requests.
🧯 If You Can't Patch
- Isolate the application behind a reverse proxy with strict input filtering
- Implement network segmentation to limit database access from the application server
🔍 How to Verify
Check if Vulnerable:
Check if adminauthenticate.php exists and contains raw SQL queries with concatenated user inputs. Test with SQL injection payloads in login form.Check Version:
Check software version in documentation or configuration files. No standard command available.Verify Fix Applied:
Verify that parameterized queries or prepared statements are used in adminauthenticate.php. Test with SQL injection payloads to confirm they're blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple failed login attempts with SQL syntax in parameters
- Successful admin logins from unusual IP addresses
Network Indicators:
- HTTP POST requests to adminauthenticate.php containing SQL keywords like UNION, SELECT, OR 1=1
SIEM Query:
source="web_logs" AND uri="*adminauthenticate.php*" AND (request_body="*UNION*" OR request_body="*SELECT*" OR request_body="*OR 1=1*")