CVE-2024-10159: Boat Booking System SQL Injection Flaw

CVE-2024-10159 Overview

CVE-2024-10159 is a SQL injection vulnerability in PHPGurukul Boat Booking System 1.0. The flaw resides in the /admin/profile.php file that powers the My Profile Page component. Attackers can manipulate the sadminusername, fullname, emailid, or mobilenumber parameters to inject arbitrary SQL statements into backend queries. The vulnerability is remotely exploitable over the network and does not require authentication context beyond reaching the affected endpoint. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed installations.

Critical Impact

Remote attackers can execute arbitrary SQL queries against the application database, leading to disclosure or manipulation of administrative profile data and potentially broader database compromise.

Affected Products

• PHPGurukul Boat Booking System 1.0
• The /admin/profile.php endpoint (My Profile Page component)
• Deployments exposing the admin interface to untrusted networks

Discovery Timeline

• 2024-10-20 - CVE-2024-10159 published to NVD
• 2024-10-22 - Last updated in NVD database

Technical Details for CVE-2024-10159

Vulnerability Analysis

The vulnerability is a SQL injection flaw classified under [CWE-89]. It affects the profile update functionality reachable through /admin/profile.php. User-supplied input from the profile form is concatenated into SQL statements without proper parameterization or sanitization. While the initial researcher advisory referenced only the mobilenumber parameter, the NVD entry notes that other parameters including sadminusername, fullname, and emailid are likely affected by the same coding pattern. Successful exploitation can yield read or write access to underlying database tables, including credential records and booking data.

Root Cause

The root cause is direct interpolation of HTTP request parameters into SQL queries within the profile management logic. The application does not employ prepared statements or input validation routines on the affected fields. This pattern is common across PHP applications that build queries through string concatenation with values pulled from $_POST or $_REQUEST superglobals.

Attack Vector

The attack is delivered over the network against the admin profile endpoint. An attacker submits crafted values in the affected POST parameters to alter query semantics. Depending on the injection point, the attacker can use UNION-based, error-based, or time-based techniques to extract data or modify records. Public disclosure of the exploit lowers the barrier for opportunistic attackers scanning for exposed PHPGurukul installations.

No verified public exploit code is referenced in the NVD record. See the GitHub CVE Documentation and VulDB entry #280945 for technical details published by the original researcher.

Detection Methods for CVE-2024-10159

Indicators of Compromise

• POST requests to /admin/profile.php containing SQL metacharacters such as single quotes, UNION SELECT, SLEEP(, or -- comment sequences in the mobilenumber, sadminusername, fullname, or emailid parameters.
• Web server or database error log entries referencing syntax errors during profile updates.
• Unexpected modifications to administrative user records or new admin accounts appearing in the database.

Detection Strategies

• Inspect web access logs for anomalous payload patterns and oversized parameter values targeting /admin/profile.php.
• Enable database query logging and alert on queries originating from the profile update flow that contain boolean tautologies or stacked statements.
• Deploy a web application firewall (WAF) ruleset for SQL injection signatures, ensuring it inspects POST bodies in addition to query strings.

Monitoring Recommendations

• Monitor authentication tables for unauthorized changes to admin credentials and session tokens.
• Track outbound database response sizes for the profile endpoint to detect bulk data extraction.
• Alert on repeated 500-class HTTP responses from /admin/profile.php, which often accompany blind SQL injection probing.

How to Mitigate CVE-2024-10159

Immediate Actions Required

• Restrict access to /admin/profile.php to trusted IP ranges or place the admin interface behind a VPN until a vendor fix is available.
• Apply WAF rules that block SQL metacharacters and injection payloads in the affected parameters.
• Audit the admin database table for unauthorized modifications and rotate administrative credentials.

Patch Information

No vendor patch has been published in the references associated with this CVE at the time of NVD publication. Refer to the PHP Gurukul homepage and VulDB CTI ID #280945 for any subsequent vendor communication. Organizations using PHPGurukul Boat Booking System 1.0 should consider replacing the affected profile handler with a parameterized implementation.

Workarounds

• Replace string-concatenated SQL in /admin/profile.php with prepared statements using PDO or MySQLi parameter binding.
• Add server-side input validation enforcing strict character sets for mobilenumber (digits only) and length limits for fullname, emailid, and sadminusername.
• Run the database account used by the application with least privilege, removing FILE, CREATE, and DROP permissions where not required.

# Example mod_security style rule to block SQLi payloads on the profile endpoint
SecRule REQUEST_URI "@streq /admin/profile.php" \
  "phase:2,chain,deny,status:403,id:1010159,msg:'CVE-2024-10159 SQLi attempt'"
  SecRule ARGS:mobilenumber|ARGS:sadminusername|ARGS:fullname|ARGS:emailid \
    "@rx (?i)(union(\s|\+)+select|sleep\s*\(|--|';|\bor\b\s+1=1)"