CVE-2024-9321
📋 TL;DR
This vulnerability allows attackers to bypass access controls in the SourceCodester Online Railway Reservation System 1.0 by manipulating the 'id' parameter in the /admin/inquiries/view_details.php file. Attackers can remotely access administrative functions without proper authorization. This affects all deployments of version 1.0 of this specific software.
💻 Affected Systems
- SourceCodester Online Railway Reservation System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full administrative access to the reservation system, allowing them to view, modify, or delete sensitive passenger data, booking information, and system configurations.
Likely Case
Unauthorized access to administrative inquiry management functions, potentially exposing passenger inquiries and personal information.
If Mitigated
No impact if proper authentication and authorization controls are implemented and the vulnerable endpoint is properly secured.
🎯 Exploit Status
Exploit details are publicly available on GitHub. Attack requires some level of access to the application but not necessarily administrative privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Check vendor website for updates. Consider implementing workarounds or replacing the software.
🔧 Temporary Workarounds
Restrict Access to Admin Directory
allImplement IP-based restrictions or additional authentication layers for the /admin/ directory
# Example Apache .htaccess for IP restriction
Order Deny,Allow
Deny from all
Allow from 192.168.1.0/24
Allow from 10.0.0.0/8
Remove Vulnerable File
linuxTemporarily remove or rename the vulnerable view_details.php file
mv /path/to/admin/inquiries/view_details.php /path/to/admin/inquiries/view_details.php.disabled
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block requests manipulating the 'id' parameter in the vulnerable endpoint
- Monitor and alert on unauthorized access attempts to administrative functions
🔍 How to Verify
Check if Vulnerable:
Test if you can access /admin/inquiries/view_details.php?id=[manipulated_value] without proper administrative authenticationCheck Version:
Check application files or documentation for version information. The system is vulnerable if running version 1.0.Verify Fix Applied:
Verify that access to the vulnerable endpoint now requires proper authentication and authorization checks📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to /admin/inquiries/view_details.php
- Multiple failed authentication attempts followed by successful access to admin functions
Network Indicators:
- Unusual traffic patterns to administrative endpoints from unauthorized IP addresses
SIEM Query:
source="web_server" AND (url="/admin/inquiries/view_details.php" AND NOT user_role="admin")