CVE-2024-3355 is a high severity (CVSS 7.3) SQL injection in SourceCodester Aplaya Beach Resort Online Reservation System 1.0, reachable through the name parameter of admin/mod_users/controller.php?action=add. The record lists no fixed version, so treat the application as vulnerable until you patch the query or take it off the network. A public exploit is reported.
What's affected
The record names one product and one version: Aplaya Beach Resort Online Reservation System 1.0 from SourceCodester, a resort booking and room management application. The affected file is admin/mod_users/controller.php?action=add, and the weakness is in how the name input is used. The record says the attack can be launched remotely and that the exploit has been disclosed to the public.
The weakness class is CWE-89, improper neutralization of special elements in an SQL command. The NVD vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. In plain terms that is network reachable, low complexity, no user interaction, and the attacker needs no account. Confidentiality, integrity and availability impacts are each rated low.
I could not find a vendor advisory or a patched release. The references are third party write ups and the VulDB entry, VDB-259459. Nothing in the record says a fixed version exists, so do not assume one does. Check the project download page before relying on that.
The application is a PHP and MySQL booking system for a resort. Booking and guest data are personal data, and the admin screens in this code base are reachable by URL path, which is exactly what automated scanners probe first.
How to check if you're exposed
This is not a package you install with a package manager, so a dependency scan will not find it by name. Look for it the way you would look for any self hosted PHP app.
- Search your servers and repositories for the application name or for the file path
admin/mod_users/controller.php?action=add. A command such asgrep -rl "controller.php" /var/wwwshows where a copy is deployed. - Check the version. This record covers version 1.0, so any deployed copy of that release is in scope.
- Check whether the application is reachable from the internet or from a wider internal network than it needs.
- Review web server access logs for requests to that path that contain quote characters, SQL keywords or unusually long values in the name input. Treat any hits as a reason to start an incident review.
- Confirm the database account the application uses. If it is a high privilege account, the damage from any injection is larger.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers the libraries your projects pull in, which helps you find the other flaws around an app like this one.
What to do now
- Find every deployed copy of Aplaya Beach Resort Online Reservation System and decide whether it still needs to exist.
- If it must stay, put it behind a VPN or an IP allow list and remove it from public access.
- Replace string built SQL for the name parameter in
admin/mod_users/controller.php?action=addwith prepared statements and bound parameters. Validate the input type as well. - Move the application to a database account with only the permissions it needs. It should not own the schema or read other databases.
- Add a web application firewall rule as a stopgap, and keep database and web logs for at least the period since the April 2024 disclosure.
- Rotate any credentials stored in that database if you find signs of probing.
- Check the vendor page again for a patched release and note the result in your risk register.
Why it matters
The cause is simple. The code takes a value from the request and places it into an SQL statement without separating data from commands. When that happens, input can change what the query does. Prepared statements fix the whole class because the database never treats the value as SQL.
Admin scripts like this are often assumed to be hidden behind a login, but the record rates the flaw as reachable remotely, and file paths in small PHP apps are easy to guess. The record does not say this flaw is being exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities list. The public disclosure of a working exploit is still enough reason to act, because it lowers the effort for anyone who finds a copy of the app online.
Quick check
Is there a patched version of Aplaya Beach Resort?
The record does not list one, and I did not find a vendor advisory. Check the project download page. Until a fixed release exists, restrict access and fix the query in your own copy.
Does CVE-2024-3355 appear in the CISA KEV list?
No. The record marks it as not known exploited. A public exploit exists, so treat it as likely to be tried, not as confirmed in use.
Sources
Last reviewed: 19 October 2026.
