CVE-2008-3124

Vulnerability

Mole Group Hotel Script 1.0 contains a SQL injection vulnerability in index.php via the file parameter. The application fails to sanitize user-supplied input before incorporating it into an SQL query [1]. This allows an attacker to inject arbitrary SQL commands. The vulnerable query is constructed directly from the file variable without proper escaping or parameterization [1].

Exploitation

The attacker can exploit this vulnerability by sending a crafted HTTP request to index.php with a malicious file parameter. No authentication is required; the attacker only needs network access to the web server [1]. An example exploit URL is: http://site.com/index.php?file=1/**/UNION/**/SELECT/**/1,CONVERT(name/**/using/**/latin1),3,4/**/FROM/**/settings/* This injection bypasses spaces using comments and extracts data from the settings table [1].

Impact

Successful exploitation allows an attacker to execute arbitrary SQL commands, leading to disclosure of sensitive information stored in the database, such as the application's configuration settings (e.g., database credentials, site configuration) [1]. The attacker can potentially retrieve any data from the database, including user credentials or other confidential records.

Mitigation

No official patch or fixed version has been released by the vendor; according to the exploit disclosure, the vendor was not notified [1]. Users should upgrade to a newer supported version if available, otherwise apply input validation and parameterized queries to the file parameter as a workaround [1]. The vulnerability is not listed in CISA KEV as of this writing.