CVE-2024-6112: Pool of Bethesda System SQLi Vulnerability

CVE-2024-6112 Overview

A critical SQL injection vulnerability has been discovered in itsourcecode Pool of Bethesda Online Reservation System version 1.0. This vulnerability exists in the index.php file, where improper handling of the log_email parameter allows remote attackers to inject malicious SQL queries. The exploit has been publicly disclosed, increasing the risk of exploitation in the wild.

Critical Impact
Remote attackers can exploit this SQL injection vulnerability without authentication to compromise database integrity, extract sensitive user data, and potentially gain unauthorized access to the underlying system.

Affected Products

Janobe Pool of Bethesda Online Reservation System 1.0
itsourcecode Pool of Bethesda Online Reservation System 1.0

Discovery Timeline

June 18, 2024 - CVE-2024-6112 published to NVD
November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-6112

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) affects the login functionality of the Pool of Bethesda Online Reservation System. The application fails to properly sanitize user-supplied input in the log_email parameter within the index.php file before incorporating it into SQL queries. This allows attackers to manipulate database queries by injecting malicious SQL statements through the email input field.

The vulnerability can be exploited remotely over the network without any authentication requirements or user interaction. Successful exploitation could allow attackers to bypass authentication mechanisms, extract sensitive information from the database including user credentials and reservation details, modify or delete database records, and potentially escalate to remote code execution depending on database configuration.

Root Cause

The root cause of this vulnerability is improper input validation and lack of parameterized queries in the PHP application. The log_email parameter is directly concatenated into SQL query strings without sanitization or the use of prepared statements. This is a common vulnerability pattern in legacy PHP applications where user input is trusted and directly embedded into database queries.

Attack Vector

The attack vector is network-based, allowing remote exploitation through the web application's login interface. An attacker can craft a malicious HTTP request containing SQL injection payloads in the log_email parameter. Since no authentication or special privileges are required, any remote attacker with network access to the application can attempt exploitation.

The vulnerability targets the authentication mechanism, meaning successful exploitation could provide immediate access to the application with elevated privileges. Additionally, depending on database permissions and configuration, attackers may be able to execute system commands through database-specific functionality such as xp_cmdshell in SQL Server or LOAD_FILE() in MySQL.

Detection Methods for CVE-2024-6112

Indicators of Compromise

Anomalous SQL syntax patterns appearing in web server logs for requests to index.php
Unusual database query errors or exceptions logged by the application
Login attempts with email addresses containing special SQL characters such as single quotes, semicolons, or comment markers
Evidence of data exfiltration through DNS or HTTP channels from the database server

Detection Strategies

Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in the log_email parameter
Monitor application logs for failed login attempts with malformed email addresses
Configure database query logging to identify anomalous or unauthorized queries
Deploy network intrusion detection systems with SQL injection signature rules

Monitoring Recommendations

Enable detailed logging for all requests to index.php and analyze for SQL injection patterns
Set up real-time alerts for database errors indicating SQL syntax issues
Monitor outbound network connections from the database server for data exfiltration attempts
Regularly audit database access logs for unauthorized data access or privilege escalation

How to Mitigate CVE-2024-6112

Immediate Actions Required

Restrict network access to the Pool of Bethesda Online Reservation System to trusted IP addresses only
Implement a Web Application Firewall (WAF) with SQL injection protection rules
Review and restrict database user privileges to minimum required permissions
Consider temporarily disabling the affected login functionality until a patch is available

Patch Information

No official vendor patch has been released for this vulnerability at the time of publication. The application is developed by itsourcecode/Janobe and users should monitor the vendor's resources for security updates. Organizations using this software should implement the workarounds below and consider migrating to a more actively maintained reservation system.

For technical details and additional information, refer to the GitHub CVE Issue Discussion and VulDB entry #268858.

Workarounds

Implement input validation on the log_email parameter to allow only valid email formats
Use prepared statements and parameterized queries when modifying the source code
Deploy a reverse proxy with SQL injection filtering capabilities in front of the application
Restrict database account permissions to prevent destructive operations and limit data access

bash

# Example: Apache mod_security rule to block SQL injection in log_email
SecRule ARGS:log_email "@detectSQLi" \
    "id:1001,\
    phase:2,\
    deny,\
    status:403,\
    msg:'SQL Injection attempt detected in log_email parameter',\
    log,\
    auditlog"