CVE-2024-3696: House Rental Management System SQLi Flaw

CVE-2024-3696 Overview

CVE-2024-3696 is a SQL injection vulnerability in Campcodes House Rental Management System 1.0. The flaw resides in the view_payment.php file, where the id parameter is passed to a database query without proper sanitization. Attackers can manipulate this argument remotely to inject arbitrary SQL statements. The vulnerability requires low-privilege authentication and no user interaction. Public disclosure includes proof-of-concept material referenced under identifier VDB-260483, increasing the likelihood of opportunistic exploitation against internet-exposed instances.

Critical Impact
Successful exploitation allows remote authenticated attackers to read, modify, or delete database contents, potentially exposing tenant records, payment data, and administrative credentials.

Affected Products

Campcodes House Rental Management System 1.0
Component: view_payment.php
Vulnerable parameter: id

Discovery Timeline

2024-04-12 - CVE-2024-3696 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3696

Vulnerability Analysis

The vulnerability is a SQL injection flaw classified under [CWE-89]. The view_payment.php script accepts an id parameter from HTTP requests and concatenates its value directly into a SQL statement. No parameterized queries, prepared statements, or input validation are applied before execution.

An authenticated attacker can supply crafted SQL syntax in the id parameter to alter the intended query logic. This enables reading arbitrary tables, bypassing authorization checks on payment records, and potentially chaining into stacked queries depending on the underlying database driver configuration.

Because the House Rental Management System handles tenant identity, lease, and payment data, exploitation directly impacts confidentiality, integrity, and availability of financial records. The application is a PHP-based web platform commonly deployed on shared hosting, which broadens the potential attack surface.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command. The developer trusts the client-supplied id value and inserts it into a query string without escaping or type casting. PHP's mysqli or legacy mysql_* APIs are used without prepared statements, which is the canonical pattern that produces [CWE-89] defects.

Attack Vector

The attack is network-based and requires low-privilege credentials to reach the authenticated view_payment.php endpoint. An attacker sends a crafted HTTP GET request with a malicious id value, such as boolean-based, UNION-based, or time-based SQL injection payloads. No user interaction is required. Because a public write-up exists on GitHub, automated scanners can weaponize the pattern against exposed installations. Refer to the GitHub Vulnerability Report for exploitation details.

Detection Methods for CVE-2024-3696

Indicators of Compromise

HTTP requests to view_payment.php containing SQL metacharacters such as single quotes, UNION SELECT, SLEEP(, --, or /* in the id parameter.
Unexpected MySQL error messages or extended query response times originating from the House Rental Management System web tier.
Web server access logs showing sequential probing of id values from a single source IP followed by anomalous 500-series responses.

Detection Strategies

Deploy web application firewall (WAF) rules that flag SQL injection signatures on the id query parameter for view_payment.php.
Enable database query logging and alert on queries containing tautologies such as OR 1=1 or UNION SELECT originating from the application service account.
Correlate authentication events with SQL error spikes to identify credential-abuse followed by injection attempts.

Monitoring Recommendations

Forward web server, PHP error, and MySQL general query logs to a centralized SIEM for correlation and retention.
Baseline normal request patterns for view_payment.php and alert on deviations in parameter length or character distribution.
Monitor egress traffic from the web server for unexpected outbound connections that could indicate post-exploitation data exfiltration.

How to Mitigate CVE-2024-3696

Immediate Actions Required

Restrict access to the House Rental Management System to trusted networks or VPN until a vendor fix is available.
Rotate all application and database credentials, especially if any exposure to untrusted networks has occurred.
Audit the payments table and related tenant records for unauthorized reads or modifications.
Deploy a WAF rule set that blocks common SQL injection payloads targeting the id parameter.

Patch Information

No vendor advisory or official patch has been published by Campcodes at the time of writing. Administrators should monitor the VulDB entry #260483 and the vendor's distribution channels for remediation updates. As an interim measure, apply a source-code fix by replacing string concatenation in view_payment.php with prepared statements using mysqli::prepare() and bound parameters, and enforce integer casting on the id value.

Workarounds

Modify view_payment.php to cast id to an integer with (int)$_GET['id'] before use in any SQL query.
Replace inline queries with mysqli or PDO prepared statements using bound parameters to eliminate the injection primitive.
Apply least-privilege permissions to the MySQL account used by the application, removing FILE, DROP, and cross-database privileges.
Disable verbose SQL error output in the PHP configuration to reduce information leakage useful for attackers.

bash

# Example WAF rule (ModSecurity) blocking SQLi patterns on view_payment.php
SecRule REQUEST_URI "@contains view_payment.php" \
    "chain,phase:2,deny,status:403,id:1003696,\
     msg:'CVE-2024-3696 SQLi attempt on id parameter'"
    SecRule ARGS:id "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|--|;|/\*|or\s+1=1)" "t:none,t:urlDecodeUni"