CVE-2024-6112: Pool of Bethesda System SQLi Vulnerability

CVE-2024-6112 Overview

A critical SQL injection vulnerability has been discovered in itsourcecode Pool of Bethesda Online Reservation System version 1.0. This vulnerability exists in the index.php file, where improper handling of the log_email parameter allows remote attackers to inject malicious SQL queries. The exploit has been publicly disclosed, increasing the risk of exploitation in the wild.

Critical Impact

Remote attackers can exploit this SQL injection vulnerability without authentication to compromise database integrity, extract sensitive user data, and potentially gain unauthorized access to the underlying system.

Affected Products

• Janobe Pool of Bethesda Online Reservation System 1.0
• itsourcecode Pool of Bethesda Online Reservation System 1.0

Discovery Timeline

• June 18, 2024 - CVE-2024-6112 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-6112

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) affects the login functionality of the Pool of Bethesda Online Reservation System. The application fails to properly sanitize user-supplied input in the log_email parameter within the index.php file before incorporating it into SQL queries. This allows attackers to manipulate database queries by injecting malicious SQL statements through the email input field.

The vulnerability can be exploited remotely over the network without any authentication requirements or user interaction. Successful exploitation could allow attackers to bypass authentication mechanisms, extract sensitive information from the database including user credentials and reservation details, modify or delete database records, and potentially escalate to remote code execution depending on database configuration.

Root Cause

The root cause of this vulnerability is improper input validation and lack of parameterized queries in the PHP application. The log_email parameter is directly concatenated into SQL query strings without sanitization or the use of prepared statements. This is a common vulnerability pattern in legacy PHP applications where user input is trusted and directly embedded into database queries.

Attack Vector

The attack vector is network-based, allowing remote exploitation through the web application's login interface. An attacker can craft a malicious HTTP request containing SQL injection payloads in the log_email parameter. Since no authentication or special privileges are required, any remote attacker with network access to the application can attempt exploitation.

The vulnerability targets the authentication mechanism, meaning successful exploitation could provide immediate access to the application with elevated privileges. Additionally, depending on database permissions and configuration, attackers may be able to execute system commands through database-specific functionality such as xp_cmdshell in SQL Server or LOAD_FILE() in MySQL.

Detection Methods for CVE-2024-6112

Indicators of Compromise

• Anomalous SQL syntax patterns appearing in web server logs for requests to index.php
• Unusual database query errors or exceptions logged by the application
• Login attempts with email addresses containing special SQL characters such as single quotes, semicolons, or comment markers
• Evidence of data exfiltration through DNS or HTTP channels from the database server

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in the log_email parameter
• Monitor application logs for failed login attempts with malformed email addresses
• Configure database query logging to identify anomalous or unauthorized queries
• Deploy network intrusion detection systems with SQL injection signature rules

Monitoring Recommendations

• Enable detailed logging for all requests to index.php and analyze for SQL injection patterns
• Set up real-time alerts for database errors indicating SQL syntax issues
• Monitor outbound network connections from the database server for data exfiltration attempts
• Regularly audit database access logs for unauthorized data access or privilege escalation

How to Mitigate CVE-2024-6112

Immediate Actions Required

• Restrict network access to the Pool of Bethesda Online Reservation System to trusted IP addresses only
• Implement a Web Application Firewall (WAF) with SQL injection protection rules
• Review and restrict database user privileges to minimum required permissions
• Consider temporarily disabling the affected login functionality until a patch is available

Patch Information

No official vendor patch has been released for this vulnerability at the time of publication. The application is developed by itsourcecode/Janobe and users should monitor the vendor's resources for security updates. Organizations using this software should implement the workarounds below and consider migrating to a more actively maintained reservation system.

For technical details and additional information, refer to the GitHub CVE Issue Discussion and VulDB entry #268858.

Workarounds

• Implement input validation on the log_email parameter to allow only valid email formats
• Use prepared statements and parameterized queries when modifying the source code
• Deploy a reverse proxy with SQL injection filtering capabilities in front of the application
• Restrict database account permissions to prevent destructive operations and limit data access

# Example: Apache mod_security rule to block SQL injection in log_email
SecRule ARGS:log_email "@detectSQLi" \
    "id:1001,\
    phase:2,\
    deny,\
    status:403,\
    msg:'SQL Injection attempt detected in log_email parameter',\
    log,\
    auditlog"