CVE-2024-10162: Boat Booking System SQLi Vulnerability

CVE-2024-10162 Overview

CVE-2024-10162 is a SQL injection vulnerability in PHPGurukul Boat Booking System 1.0. The flaw resides in the /admin/edit-subadmin.php file, part of the Edit Subdomain Details page. Attackers can manipulate the sadminusername, fullname, emailid, and mobilenumber parameters to inject arbitrary SQL statements [CWE-89]. The vulnerability is remotely exploitable and requires low-privileged authentication. Public disclosure of the exploit increases the likelihood of opportunistic scanning. While the initial researcher advisory referenced only the mobilenumber parameter, additional input fields on the same page share the same weakness.

Critical Impact
Authenticated attackers can inject SQL into administrative input fields, potentially exposing sensitive database contents in the Boat Booking System backend.

Affected Products

PHPGurukul Boat Booking System 1.0
Component: /admin/edit-subadmin.php (Edit Subdomain Details Page)
Affected parameters: sadminusername, fullname, emailid, mobilenumber

Discovery Timeline

2024-10-20 - CVE-2024-10162 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10162

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-supplied input in the administrative sub-admin edit workflow. The edit-subadmin.php script accepts POST parameters and concatenates them directly into SQL queries without parameterized statements or input sanitization. An authenticated attacker with access to the admin panel can craft malicious payloads that alter the intended query logic. The public proof-of-concept demonstrates injection through the mobilenumber parameter, though the surrounding form fields exhibit the same unsafe query construction. Successful exploitation allows extraction of database contents, modification of stored records, and potential enumeration of credential material stored in the application schema.

Root Cause

The root cause is the direct concatenation of HTTP request parameters into SQL statements in /admin/edit-subadmin.php. The application does not use prepared statements, bound parameters, or context-aware escaping. Standard input validation routines are absent for the affected form fields, allowing SQL metacharacters to reach the database engine unfiltered.

Attack Vector

The attack originates over the network against the admin interface. An attacker with valid sub-admin or admin credentials submits a modified edit form containing SQL syntax in one of the affected parameters. The injected payload executes within the database session used by the application. Because the affected page sits behind authentication, exploitation requires either legitimate low-privilege access or a prior credential compromise. Public disclosure of exploitation details lowers the technical barrier for follow-on attacks.

The vulnerability manifests in the form-handling logic of edit-subadmin.php. See the GitHub PoC Repository for the disclosed payload structure and reproduction steps.

Detection Methods for CVE-2024-10162

Indicators of Compromise

Unexpected POST requests to /admin/edit-subadmin.php containing SQL metacharacters such as ', --, UNION, or SLEEP( in the mobilenumber, emailid, fullname, or sadminusername fields.
Web server access logs showing repeated edit-subadmin submissions from a single source within a short interval.
Database error messages surfaced to the admin UI indicating syntax errors near quoted parameter values.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect POST bodies to /admin/edit-subadmin.php for SQL injection signatures.
Enable database query logging and alert on queries originating from the Boat Booking System user that contain UNION SELECT, boolean tautologies, or time-delay functions.
Correlate admin authentication events with subsequent edit-subadmin activity to identify anomalous session behavior.

Monitoring Recommendations

Monitor authentication logs for the admin panel and flag brute-force or credential-stuffing attempts targeting sub-admin accounts.
Track outbound database result volumes from the application host to identify bulk data extraction consistent with UNION-based injection.
Retain HTTP request bodies for administrative endpoints to support forensic reconstruction of injected payloads.

How to Mitigate CVE-2024-10162

Immediate Actions Required

Restrict network access to the /admin/ directory using IP allowlisting or VPN-only exposure until a patch is applied.
Rotate credentials for all sub-admin and admin accounts and enforce strong password policies.
Audit the database for unauthorized modifications to the sub-admin table and related records.

Patch Information

No vendor security patch has been published for PHPGurukul Boat Booking System 1.0 at the time of this writing. Refer to the PHP Gurukul website and the VulDB entry #280948 for updates on remediation guidance.

Workarounds

Rewrite the vulnerable query in /admin/edit-subadmin.php to use PHP Data Objects (PDO) prepared statements with bound parameters for sadminusername, fullname, emailid, and mobilenumber.
Apply server-side input validation that constrains each field to its expected character set (for example, digits only for mobilenumber, RFC 5322 syntax for emailid).
Deploy a WAF profile that blocks common SQL injection payloads directed at administrative endpoints.

bash

# Example ModSecurity rule to block SQL metacharacters in edit-subadmin parameters
SecRule REQUEST_URI "@streq /admin/edit-subadmin.php" \
    "id:1010162,phase:2,deny,status:403,log,\
    msg:'Possible CVE-2024-10162 SQLi attempt',\
    chain"
    SecRule ARGS:mobilenumber|ARGS:emailid|ARGS:fullname|ARGS:sadminusername \
        "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|--|';|/\*)"