CVE-2024-3347: Airline Ticket Reservation System SQLi

CVE-2024-3347 Overview

CVE-2024-3347 is a SQL injection vulnerability in SourceCodester Airline Ticket Reservation System 1.0. The flaw resides in the activate_jet_details_form_handler.php file, where the jet_id parameter is passed to a database query without proper sanitization. Remote attackers can manipulate this parameter to inject arbitrary SQL statements against the backend database. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed installations. The issue is tracked as VulDB identifier VDB-259451 and is classified under [CWE-89].

Critical Impact
Unauthenticated attackers can execute arbitrary SQL queries remotely over the network, leading to full compromise of confidentiality, integrity, and availability of the application database.

Affected Products

Sanchitkmr Airline Ticket Reservation System 1.0
File: activate_jet_details_form_handler.php
Vulnerable parameter: jet_id

Discovery Timeline

2024-04-05 - CVE-2024-3347 published to NVD
2025-02-18 - Last updated in NVD database

Technical Details for CVE-2024-3347

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw [CWE-89] in the PHP component activate_jet_details_form_handler.php. The application accepts user-supplied input through the jet_id argument and concatenates it directly into a SQL statement. No prepared statements, parameterized queries, or input sanitization routines are applied before the query is sent to the database engine.

Because the endpoint is reachable over the network and requires no authentication or user interaction, attackers can submit crafted HTTP requests directly. Successful exploitation grants the ability to read arbitrary database tables, modify records such as reservation and account data, or drop data outright. Depending on database permissions, attackers may also pivot to file system access or stored procedure abuse.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command. The jet_id parameter flows from an HTTP request into a dynamically built query string without type casting, escaping, or use of bound parameters. PHP's MySQL extensions permit such concatenation patterns when developers do not adopt PDO or mysqli prepared statements.

Attack Vector

An attacker sends an HTTP request to activate_jet_details_form_handler.php with a malicious jet_id value containing SQL metacharacters such as single quotes, UNION SELECT clauses, or boolean-based payloads. The attack requires no privileges and no user interaction. Publicly disclosed proof-of-concept documentation describing the injection technique is available in the GitHub PoC Documentation and the VulDB entry #259451.

No verified exploit code is reproduced here. Refer to the linked advisories for technical proof-of-concept details.

Detection Methods for CVE-2024-3347

Indicators of Compromise

HTTP requests targeting activate_jet_details_form_handler.php containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( in the jet_id parameter.
Web server access logs showing unusually long or URL-encoded jet_id values from a single source IP.
Database error messages or stack traces returned in HTTP responses following requests to the affected handler.
Unexpected database query patterns referencing information_schema tables originating from the application user.

Detection Strategies

Deploy web application firewall (WAF) signatures that flag SQL injection patterns against the affected PHP endpoint.
Enable database query logging and alert on anomalous queries originating from the application service account.
Monitor for repeated 500-series HTTP responses from activate_jet_details_form_handler.php, which often indicate injection probing.

Monitoring Recommendations

Forward web server and database logs to a centralized analytics platform for correlation and retention.
Baseline normal jet_id parameter values (typically numeric) and alert on non-numeric or oversized inputs.
Track outbound database connections and data egress volumes to identify exfiltration attempts following suspected injection.

How to Mitigate CVE-2024-3347

Immediate Actions Required

Restrict network access to the Airline Ticket Reservation System until remediation is applied, placing it behind authenticated VPN or IP allowlists.
Deploy WAF rules to block SQL injection payloads targeting the jet_id parameter on activate_jet_details_form_handler.php.
Audit the database for unauthorized modifications, new administrative users, or evidence of data exfiltration.
Rotate database credentials and application secrets if compromise is suspected.

Patch Information

No vendor patch has been published for Sanchitkmr Airline Ticket Reservation System 1.0 in the referenced advisories. Operators should refactor activate_jet_details_form_handler.php to use parameterized queries via PDO or mysqli prepared statements, and validate that jet_id is a strictly numeric value before any database interaction. Consult the VulDB advisory #259451 for additional context.

Workarounds

Apply server-side input validation to enforce that jet_id matches a strict numeric pattern such as ^[0-9]+$.
Run the database account used by the application with least-privilege permissions, removing FILE, DROP, and administrative grants.
Disable verbose database error reporting in production to prevent error-based injection feedback.
Consider retiring this application in favor of a maintained alternative if patching is not feasible.

bash

# Example WAF rule (ModSecurity) to block SQLi against the vulnerable endpoint
SecRule REQUEST_URI "@contains activate_jet_details_form_handler.php" \
  "chain,phase:2,deny,status:403,id:1003347,msg:'CVE-2024-3347 SQLi attempt'"
SecRule ARGS:jet_id "!@rx ^[0-9]+$" "t:none"