CVE-2024-3350: Aplaya Resort Reservation SQL Injection

CVE-2024-3350 Overview

A critical SQL injection vulnerability has been identified in SourceCodester Aplaya Beach Resort Online Reservation System version 1.0. The vulnerability exists in the admin/mod_room/index.php file, where the id parameter is not properly sanitized before being used in SQL queries. This flaw allows remote attackers to inject malicious SQL commands, potentially leading to unauthorized data access, data modification, or complete database compromise.

Critical Impact

Remote attackers can exploit this SQL injection vulnerability to extract sensitive customer data, modify reservation records, or gain administrative access to the reservation system without authentication.

Affected Products

• Janobe Aplaya Beach Resort Online Reservation System 1.0
• SourceCodester Aplaya Beach Resort Online Reservation System 1.0

Discovery Timeline

• April 5, 2024 - CVE-2024-3350 published to NVD
• February 11, 2025 - Last updated in NVD database

Technical Details for CVE-2024-3350

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) affects the room management functionality in the administrative panel of the Aplaya Beach Resort Online Reservation System. The vulnerable endpoint at admin/mod_room/index.php accepts an id parameter that is directly incorporated into database queries without proper sanitization or parameterization. This allows attackers to manipulate the SQL query structure by injecting malicious SQL syntax through the id parameter.

The attack can be executed remotely over the network without requiring any authentication or user interaction. Successful exploitation grants attackers the ability to read, modify, or delete database contents, potentially compromising confidentiality, integrity, and availability of the reservation system.

Root Cause

The root cause of this vulnerability is improper input validation and the use of dynamic SQL queries that concatenate user-supplied input directly into SQL statements. The application fails to implement parameterized queries or prepared statements, which would prevent SQL injection by treating user input as data rather than executable code.

Attack Vector

The attack is network-based and can be launched remotely. An attacker can craft malicious HTTP requests targeting the admin/mod_room/index.php endpoint with specially crafted SQL payloads in the id parameter. The exploit has been publicly disclosed, making it accessible to potential attackers who can use techniques such as UNION-based, error-based, or blind SQL injection to extract database information.

The vulnerability allows attackers to bypass application logic by manipulating SQL queries. For example, an attacker could append SQL clauses to the id parameter to enumerate database tables, extract user credentials, or modify reservation data. Detailed technical information is available in the GitHub vulnerability report and VulDB entry #259454.

Detection Methods for CVE-2024-3350

Indicators of Compromise

• Unusual SQL error messages appearing in application logs or responses from admin/mod_room/index.php
• HTTP requests to /admin/mod_room/index.php containing SQL keywords such as UNION, SELECT, OR 1=1, or comment sequences (--, #)
• Unexpected database queries or performance degradation indicating extraction operations
• Unauthorized changes to room records or reservation data

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the id parameter
• Monitor HTTP access logs for requests to admin/mod_room/index.php with suspicious parameter values containing SQL syntax
• Enable database query logging and alert on queries with unusual structures or error rates
• Implement intrusion detection signatures for known SQL injection attack patterns

Monitoring Recommendations

• Review web server access logs regularly for signs of SQL injection attempts targeting administrative endpoints
• Set up real-time alerting for database errors that may indicate injection attempts
• Monitor for unauthorized data access patterns or bulk data extraction from the reservation database
• Track changes to sensitive database tables and alert on unexpected modifications

How to Mitigate CVE-2024-3350

Immediate Actions Required

• Restrict access to the admin/mod_room/index.php endpoint using IP whitelisting or VPN requirements
• Deploy a Web Application Firewall (WAF) with SQL injection protection rules in front of the application
• Implement input validation to reject requests with SQL special characters in the id parameter
• Consider taking the vulnerable application offline until a patch is available or code remediation is complete

Patch Information

No official vendor patch is currently available for this vulnerability. Organizations using this software should contact the vendor (SourceCodester/Janobe) for remediation guidance or consider implementing custom code fixes to address the SQL injection vulnerability by using parameterized queries.

For technical details and vulnerability information, refer to:

• VulDB Entry #259454
• VulDB CTI ID #259454

Workarounds

• Implement parameterized queries or prepared statements in the admin/mod_room/index.php file to prevent SQL injection
• Add input validation to ensure the id parameter contains only numeric values before processing
• Place the application behind a reverse proxy with SQL injection filtering capabilities
• Limit database user privileges for the application to minimum required permissions (read-only where possible)

# Example Apache .htaccess configuration to restrict admin access by IP
<Directory "/var/www/html/admin">
    Order deny,allow
    Deny from all
    Allow from 192.168.1.0/24
    Allow from 10.0.0.0/8
</Directory>

# Example mod_security rule to block SQL injection patterns
SecRule ARGS:id "@rx (\b(union|select|insert|update|delete|drop|alter|create)\b|--|\#|')" \
    "id:100001,phase:2,deny,status:403,msg:'SQL Injection Attempt Blocked'"