CVE-2024-10411: Janobe Hotel Reservation System SQLi Flaw

CVE-2024-10411 is a critical SQL injection vulnerability in Janobe Online Hotel Reservation System affecting room management functions. Attackers can exploit this flaw remotely to manipulate database queries. This article covers technical details, affected versions, security impact, and mitigation strategies.

CVE-2024-10411 Overview

CVE-2024-10411 is a SQL injection vulnerability in the Janobe/SourceCodester Online Hotel Reservation System 1.0. The flaw resides in the doCancelRoom, doCancel, doConfirm, doCheckin, and doCheckout functions inside /marimar/admin/mod_room/controller.php. Attackers can manipulate the id parameter to inject arbitrary SQL statements against the backend database. Exploitation requires network access and low-privilege authentication, and a proof of concept has been published publicly. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated remote attackers can inject arbitrary SQL through the id parameter to read, modify, or delete hotel reservation data.

Affected Products

Janobe Online Hotel Reservation System 1.0
SourceCodester Online Hotel Reservation System (distributed via SourceCodester)
The marimar/admin/mod_room/controller.php component

Discovery Timeline

2024-10-27 - CVE-2024-10411 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10411

Vulnerability Analysis

The vulnerability affects the room management controller of the Online Hotel Reservation System 1.0. Multiple administrative actions, including cancellation, confirmation, check-in, and check-out, share the same insecure pattern. Each function accepts an id request parameter and concatenates it directly into a SQL query without parameterization or type validation. An authenticated attacker with access to the admin module can invoke these endpoints and inject SQL clauses through the id value. The impact covers confidentiality, integrity, and availability of the reservation database, since injected statements can query, alter, or destroy stored records.

Root Cause

The root cause is improper neutralization of user-supplied input before use in a SQL statement [CWE-89]. The id parameter is embedded into dynamic queries in /marimar/admin/mod_room/controller.php without prepared statements or input sanitization. Any function that reuses this parameter inherits the same defect.

Attack Vector

Exploitation is remote and executed over HTTP against the admin controller. The attacker needs valid low-privilege credentials on the application, then supplies a crafted id value to endpoints such as doCancelRoom, doCancel, doConfirm, doCheckin, or doCheckout. Injected SQL executes with the privileges of the database account used by the application. A public proof of concept is available in the GitHub PoC Repository and referenced by VulDB #281940.

No verified exploit code is reproduced here. Refer to the linked PoC for request-level technical detail.

Detection Methods for CVE-2024-10411

Indicators of Compromise

HTTP requests to /marimar/admin/mod_room/controller.php with an id parameter containing SQL metacharacters such as ', --, UNION, SLEEP(, or OR 1=1.
Web server access logs showing repeated doCancelRoom, doCancel, doConfirm, doCheckin, or doCheckout actions from a single source in a short timeframe.
Database error messages or unexpected 500 responses correlated with malformed id values.

Detection Strategies

Deploy web application firewall (WAF) signatures that flag SQL injection patterns in the id parameter of the mod_room controller endpoints.
Enable database query logging and alert on syntax errors, UNION SELECT statements, or time-based delay functions originating from the reservation application.
Correlate authenticated admin sessions with anomalous query volume or non-standard SQL error rates.

Monitoring Recommendations

Monitor the /marimar/admin/mod_room/ path for repeated requests using the same session cookie but varying id payloads.
Track outbound database traffic for schema enumeration behavior such as reads against information_schema.
Alert on admin account logins from new IP addresses or geolocations preceding controller access.

How to Mitigate CVE-2024-10411

Immediate Actions Required

Restrict network access to the /marimar/admin/ path to trusted management IP ranges only.
Rotate credentials for all administrative accounts and any database user consumed by the application.
Deploy a WAF rule blocking SQL metacharacters and boolean/time-based injection patterns targeting the id parameter.

Patch Information

No vendor advisory or patch is listed in the enriched CVE data. Janobe/SourceCodester has not published a fixed release for Online Hotel Reservation System 1.0 at time of writing. Track updates through the SourceCodester Resource Portal and the VulDB entry for future remediation guidance.

Workarounds

Rewrite the affected functions in /marimar/admin/mod_room/controller.php to use parameterized queries or prepared statements for the id value.
Enforce server-side type validation so that id accepts only integer values before it reaches any SQL context.
Apply least-privilege permissions to the application database user so that injected statements cannot alter schema or read sensitive tables.
Consider retiring the application in production environments until an upstream fix is released, given the open-source nature and lack of vendor patching cadence.

bash

# Example WAF rule concept (ModSecurity) to block SQLi in the id parameter
SecRule REQUEST_URI "@contains /marimar/admin/mod_room/controller.php" \
    "chain,phase:2,deny,status:403,id:1004411,msg:'CVE-2024-10411 SQLi attempt'"
    SecRule ARGS:id "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|--|;|\bor\b\s+1=1)" "t:none,t:urlDecode"