CVE-2024-6745: Simple Ticket Booking SQLi Vulnerability

CVE-2024-6745 Overview

A critical SQL injection vulnerability has been identified in code-projects Simple Ticket Booking version 1.0. The vulnerability exists within the adminauthenticate.php file, specifically in the Login component. Attackers can exploit this flaw by manipulating the email and password parameters, allowing them to inject malicious SQL queries and potentially gain unauthorized access to the application's database and administrative functions.

Critical Impact

Unauthenticated attackers can remotely exploit this SQL injection vulnerability to bypass authentication, extract sensitive database information, or manipulate data within the Simple Ticket Booking application.

Affected Products

• code-projects Simple Ticket Booking 1.0

Discovery Timeline

• 2024-07-15 - CVE-2024-6745 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-6745

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) affects the authentication mechanism of the Simple Ticket Booking application. The adminauthenticate.php file fails to properly sanitize user-supplied input in the email and password form fields before incorporating them into SQL queries. This lack of input validation allows attackers to inject arbitrary SQL commands that execute within the context of the database server.

The vulnerability is particularly concerning as it affects the administrative login functionality, meaning successful exploitation could grant attackers full administrative privileges to the ticket booking system. Since the attack can be launched remotely over the network without any prior authentication, the exposure is significant for any publicly accessible deployment of this application.

Root Cause

The root cause of this vulnerability is the improper handling of user input in the login form processing code. The adminauthenticate.php script directly incorporates the email and password parameters into database queries without proper sanitization, parameterization, or prepared statements. This classic SQL injection pattern allows attackers to modify the query logic by inserting special SQL characters and commands.

Attack Vector

The attack can be executed remotely over the network against any accessible instance of the Simple Ticket Booking application. An attacker needs only to craft malicious input containing SQL metacharacters and commands in the email or password fields of the admin login form. Common exploitation techniques include:

• Authentication bypass using payloads like ' OR '1'='1'-- in the email or password fields
• Data extraction through UNION-based or blind SQL injection techniques
• Potential database manipulation or destruction through injected DELETE or DROP statements

The exploit has been publicly disclosed, increasing the risk of opportunistic attacks against vulnerable installations. For detailed technical information, refer to the GitHub CVE Issue Discussion and VulDB #271476.

Detection Methods for CVE-2024-6745

Indicators of Compromise

• Unusual or malformed requests to adminauthenticate.php containing SQL metacharacters (', ", --, ;, /*)
• Multiple failed login attempts followed by a successful authentication from the same source IP
• Database error messages in web server logs indicating SQL syntax errors
• Unexpected database queries or data modifications in database audit logs

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in HTTP request parameters
• Monitor access logs for requests to adminauthenticate.php containing suspicious characters or encoded payloads
• Deploy intrusion detection system (IDS) signatures targeting SQL injection attempts
• Enable database query logging and audit for anomalous query patterns

Monitoring Recommendations

• Configure real-time alerting for authentication anomalies in the Simple Ticket Booking admin panel
• Establish baseline metrics for normal login activity and alert on deviations
• Implement database activity monitoring to detect unauthorized data access or extraction
• Review web server logs regularly for signs of SQL injection probing or exploitation

How to Mitigate CVE-2024-6745

Immediate Actions Required

• Take the Simple Ticket Booking application offline if exposed to untrusted networks until remediation is complete
• Implement a Web Application Firewall (WAF) with SQL injection detection rules as a temporary protective measure
• Review database access logs for evidence of prior exploitation and rotate database credentials if compromise is suspected
• Restrict network access to the administrative login page to trusted IP addresses only

Patch Information

As of the last update, no official vendor patch has been released for this vulnerability. The application is a code-projects demonstration application, and users should consider alternative solutions or implement manual code fixes. For updates, monitor the VulDB entry and project resources.

Workarounds

• Manually modify adminauthenticate.php to use parameterized queries or prepared statements for all database operations involving user input
• Implement server-side input validation to reject email and password values containing SQL metacharacters
• Deploy the application behind a reverse proxy with SQL injection filtering capabilities
• Consider migrating to a more actively maintained ticket booking solution with proper security practices

# Example: Restrict access to admin authentication endpoint via Apache .htaccess
<Files "adminauthenticate.php">
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
    Allow from 10.0.0.0/8
</Files>