CVE-2024-10157: Boat Booking System SQLi Vulnerability

CVE-2024-10157 Overview

A SQL Injection vulnerability has been identified in PHPGurukul Boat Booking System version 1.0. This vulnerability exists in the password recovery functionality located at /admin/password-recovery.php. The flaw allows remote attackers to inject malicious SQL statements through the username and mobileno parameters on the Reset Your Password page. Due to insufficient input validation and sanitization, user-supplied data is directly incorporated into SQL queries, enabling attackers to manipulate database operations.

Critical Impact

Remote attackers can exploit this SQL Injection vulnerability to bypass authentication, extract sensitive data from the database, modify or delete records, and potentially gain administrative access to the Boat Booking System.

Affected Products

• PHPGurukul Boat Booking System 1.0
• Boat Booking System Admin Panel (/admin/password-recovery.php)
• Reset Your Password Page Component

Discovery Timeline

• 2024-10-19 - CVE-2024-10157 published to NVD
• 2025-04-03 - Last updated in NVD database

Technical Details for CVE-2024-10157

Vulnerability Analysis

This vulnerability represents a classic SQL Injection flaw in a PHP-based web application. The password recovery functionality in PHPGurukul Boat Booking System fails to properly sanitize user input before incorporating it into database queries. When a user attempts to reset their password, the application accepts username and mobileno parameters and uses them directly in SQL statements without adequate validation or parameterized queries.

The exploitation can be performed remotely without authentication, as the password recovery page is accessible to unauthenticated users by design. This makes the vulnerability particularly dangerous as it provides an entry point for attackers to compromise the system without requiring any prior access.

Root Cause

The root cause of CVE-2024-10157 is improper input validation and the absence of prepared statements or parameterized queries in the /admin/password-recovery.php file. The application directly concatenates user-supplied input into SQL query strings, violating secure coding practices. This implementation fails to distinguish between data and executable code, allowing SQL meta-characters to escape the data context and modify the query logic.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can craft malicious HTTP requests to the /admin/password-recovery.php endpoint, injecting SQL payloads through the username or mobileno parameters. These payloads can include SQL operators and statements designed to extract data, bypass authentication checks, or perform unauthorized database operations.

The vulnerability can be exploited by submitting specially crafted values containing SQL syntax such as single quotes, UNION statements, or boolean-based conditions that alter the intended query behavior. Technical details and proof-of-concept information have been documented in the GitHub PoC Repository.

Detection Methods for CVE-2024-10157

Indicators of Compromise

• Unusual or malformed requests to /admin/password-recovery.php containing SQL syntax characters (single quotes, double dashes, UNION keywords)
• Elevated database errors or exceptions in application logs during password recovery attempts
• Unexpected database query patterns or data extraction attempts in database audit logs
• Multiple failed or anomalous password recovery attempts from single IP addresses

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns in HTTP parameters
• Enable detailed logging on the web server for the /admin/ directory and monitor for suspicious request patterns
• Implement database activity monitoring to identify unusual query structures or unauthorized data access
• Configure intrusion detection systems (IDS) with signatures for common SQL injection attack patterns

Monitoring Recommendations

• Regularly review web server access logs for requests to /admin/password-recovery.php with encoded or malicious payloads
• Set up real-time alerting for SQL syntax patterns appearing in HTTP POST parameters
• Monitor database query logs for anomalous SELECT, UNION, or extraction queries originating from the web application
• Implement rate limiting and anomaly detection for the password recovery endpoint

How to Mitigate CVE-2024-10157

Immediate Actions Required

• Restrict access to the /admin/ directory using IP whitelisting or VPN requirements until patches are applied
• Disable the password recovery functionality temporarily if it is not essential for operations
• Deploy a Web Application Firewall (WAF) with SQL injection protection rules in front of the application
• Review and audit database accounts used by the application, ensuring least-privilege access

Patch Information

At the time of this publication, no official vendor patch has been released for this vulnerability. Organizations using PHPGurukul Boat Booking System 1.0 should monitor the PHP Gurukul Website for security updates. Additional vulnerability details are available at VulDB #280943.

Workarounds

• Implement input validation at the application level to reject SQL meta-characters in the username and mobileno fields
• Modify the vulnerable PHP code to use prepared statements with parameterized queries (PDO or MySQLi)
• Add a CAPTCHA mechanism to the password recovery page to slow automated exploitation attempts
• Consider replacing the vulnerable component with a custom-developed secure alternative using modern security practices

# Apache .htaccess configuration to restrict admin access
<Directory "/var/www/html/admin">
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
    # Add your trusted IP ranges above
</Directory>