CVE-2024-6371: Pool of Bethesda System SQLi Vulnerability

CVE-2024-6371 Overview

A critical SQL injection vulnerability has been identified in itsourcecode Pool of Bethesda Online Reservation System version 1.0. The vulnerability exists in the controller.php file and can be exploited through manipulation of the rmtype_id parameter. This security flaw allows remote attackers to inject malicious SQL queries, potentially compromising the entire database backend and exposing sensitive reservation and customer data.

Critical Impact

Remote attackers can exploit this SQL injection vulnerability to extract, modify, or delete database contents without authentication, potentially leading to complete database compromise and unauthorized access to customer information.

Affected Products

• Janobe Pool of Bethesda Online Reservation System 1.0
• itsourcecode Pool of Bethesda Online Reservation System 1.0

Discovery Timeline

• 2024-06-27 - CVE-2024-6371 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-6371

Vulnerability Analysis

This vulnerability is classified as CWE-89 (SQL Injection), which occurs when user-controllable input is incorporated into database queries without proper sanitization or parameterization. The affected file controller.php accepts the rmtype_id parameter and directly incorporates it into SQL statements, creating a classic injection point.

The network-accessible nature of this vulnerability means any attacker with HTTP access to the application can attempt exploitation. The application fails to implement prepared statements or input validation for the rmtype_id parameter, allowing attackers to break out of the intended query structure and inject arbitrary SQL commands.

Root Cause

The root cause of CVE-2024-6371 is improper input validation and lack of parameterized queries in the controller.php file. The rmtype_id parameter is directly concatenated into SQL queries without sanitization, allowing malicious SQL code to be injected. This represents a fundamental secure coding violation where user input is trusted without validation.

Attack Vector

The attack can be launched remotely over the network without requiring authentication. An attacker can craft malicious HTTP requests containing SQL injection payloads in the rmtype_id parameter. The exploit has been publicly disclosed, increasing the risk of opportunistic attacks against unpatched systems.

The attacker sends specially crafted requests to controller.php with malicious SQL syntax embedded in the rmtype_id parameter. This allows the attacker to manipulate query logic, extract data via UNION-based or blind SQL injection techniques, or potentially execute administrative database operations depending on database privileges.

Detection Methods for CVE-2024-6371

Indicators of Compromise

• Unusual SQL syntax patterns in web server access logs targeting controller.php
• Database query errors or exceptions related to the rmtype_id parameter
• Unexpected database queries containing UNION SELECT, SLEEP(), or other SQL injection signatures
• Anomalous database activity such as bulk data extraction or unauthorized schema queries

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect SQL injection patterns in the rmtype_id parameter
• Implement application-level logging to capture all requests to controller.php with parameter values
• Configure database activity monitoring to alert on suspicious query patterns or error rates
• Use intrusion detection systems (IDS) with SQL injection signature sets

Monitoring Recommendations

• Monitor web server logs for requests to controller.php containing suspicious characters such as single quotes, double dashes, or semicolons
• Track database error logs for SQL syntax errors that may indicate injection attempts
• Set up alerts for unusual database query volume or patterns originating from the web application
• Review authentication logs for signs of unauthorized access following potential data exfiltration

How to Mitigate CVE-2024-6371

Immediate Actions Required

• Restrict access to the Pool of Bethesda Online Reservation System to trusted networks only
• Implement Web Application Firewall rules to block SQL injection payloads in the rmtype_id parameter
• Review application logs for signs of prior exploitation attempts
• Consider taking the application offline until a fix can be implemented

Patch Information

No official vendor patch is currently available for this vulnerability. Organizations using the Pool of Bethesda Online Reservation System 1.0 should contact the vendor (itsourcecode/Janobe) for security updates. Technical details about the vulnerability are documented in the GitHub CVE Documentation and tracked via VulDB #269804.

Workarounds

• Implement input validation to sanitize the rmtype_id parameter, accepting only numeric values
• Modify the controller.php file to use prepared statements with parameterized queries
• Deploy a reverse proxy or WAF with SQL injection protection enabled
• Apply principle of least privilege to database accounts used by the application
• Consider using a virtual patching solution until an official fix is released

# Example WAF rule to block SQL injection in rmtype_id parameter
# ModSecurity rule example
SecRule ARGS:rmtype_id "@detectSQLi" \
    "id:100001,\
    phase:2,\
    deny,\
    status:403,\
    log,\
    msg:'SQL Injection attempt detected in rmtype_id parameter'"