CVE-2024-3697: House Rental Management System SQL Injection

CVE-2024-3697 Overview

CVE-2024-3697 is a SQL injection vulnerability in Campcodes House Rental Management System 1.0. The flaw resides in the manage_tenant.php file, where the id parameter is passed directly into a SQL query without proper sanitization. An authenticated remote attacker can manipulate this parameter to inject arbitrary SQL statements. The vulnerability has been publicly disclosed under VulDB identifier VDB-260484, and exploit details are available in the public domain. The weakness is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Remote attackers with low privileges can extract, modify, or destroy tenant database records by injecting SQL through the id parameter of manage_tenant.php.

Affected Products

Campcodes House Rental Management System 1.0
Component: manage_tenant.php
CPE: cpe:2.3:a:campcodes:house_rental_management_system:1.0:*:*:*:*:*:*:*

Discovery Timeline

2024-04-12 - CVE-2024-3697 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3697

Vulnerability Analysis

The vulnerability exists in the tenant management workflow of Campcodes House Rental Management System 1.0. The manage_tenant.php script accepts an id parameter from HTTP requests and concatenates it into a backend SQL query. Because the application fails to validate or parameterize this input, an attacker can append SQL operators, subqueries, or UNION clauses to the request. Successful exploitation grants access to the underlying database used to store tenant, property, and billing records. An attacker with any authenticated session can leverage the flaw to read sensitive data, tamper with records, or drop tables, undermining the confidentiality, integrity, and availability of the platform.

Root Cause

The root cause is improper neutralization of user-supplied input passed to a SQL statement [CWE-89]. The id argument in manage_tenant.php is placed directly into a query string rather than being bound as a prepared-statement parameter. No allow-list validation or type coercion is applied before the value reaches the database driver.

Attack Vector

Exploitation is performed remotely over the network against the web interface. The attacker sends a crafted HTTP GET or POST request to manage_tenant.php with a malicious id value. Low-privilege authentication is required, but user interaction is not. Public proof-of-concept material has been released through the GitHub Vulnerability Report and VulDB entry #260484.

No verified code examples are available. Refer to the linked advisories for reproduction details.

Detection Methods for CVE-2024-3697

Indicators of Compromise

HTTP requests to manage_tenant.php containing SQL metacharacters such as ', ", --, /*, UNION, SELECT, SLEEP(, or BENCHMARK( in the id parameter.
Web server access logs showing unusually long query strings or encoded payloads directed at the tenant management endpoint.
Database error messages returned in HTTP responses indicating syntax errors from the MySQL/MariaDB backend.

Detection Strategies

Deploy a web application firewall (WAF) rule set that inspects id parameters on manage_tenant.php for SQL injection signatures.
Enable database query logging and alert on parameterized queries that suddenly include tautologies (OR 1=1), stacked queries, or INFORMATION_SCHEMA references.
Correlate authentication logs with anomalous request volumes to detect credentialed attackers probing the endpoint.

Monitoring Recommendations

Monitor for spikes in 500-level HTTP responses from manage_tenant.php, which often accompany SQL injection probing.
Track outbound database connections and unusual read volumes from the application service account.
Alert on file writes to web-accessible directories, which could indicate INTO OUTFILE abuse following successful injection.

How to Mitigate CVE-2024-3697

Immediate Actions Required

Restrict access to manage_tenant.php to trusted networks or via VPN until a fix is validated in the environment.
Rotate any credentials, session tokens, and database secrets that may have been exposed by an attacker with SQL read access.
Audit tenant, user, and billing tables for unauthorized modifications and preserve web and database logs for forensic review.

Patch Information

No vendor advisory or official patch has been published by Campcodes for House Rental Management System 1.0 at the time of the NVD entry. Consult the VulDB record #260484 and the VulDB submission #314203 for the latest disclosure status. Organizations running this application should evaluate migration to a supported alternative or implement compensating controls until an official fix is available.

Workarounds

Place a WAF such as ModSecurity with the OWASP Core Rule Set in front of the application to block SQL injection payloads targeting the id parameter.
Modify the source of manage_tenant.php to cast id to an integer (intval($_GET['id'])) and refactor queries to use prepared statements with bound parameters.
Apply the principle of least privilege to the database account used by the application, removing FILE, DROP, and ALTER privileges where not required.

bash

# Example ModSecurity rule to block SQLi patterns on manage_tenant.php
SecRule REQUEST_URI "@contains manage_tenant.php" \
    "chain,phase:2,deny,status:403,id:1002024,log,\
     msg:'Potential SQLi against CVE-2024-3697'"
    SecRule ARGS:id "@rx (?i:(union(\s|/\*.*\*/)+select|('|\")\s*or\s+\d+=\d+|sleep\s*\(|benchmark\s*\(|information_schema))" \
        "t:none,t:urlDecodeUni"