PT-2019-15397 · Sourcecodester · Sourcecodester Restaurant Management System

Publicado 2019-10-24 · Atualizado 2019-10-28 · CVE-2019-18414

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sourcecodester Restaurant Management System version 1.0

Description The issue is related to a Cross Site Request Forgery vulnerability in the admin/staff-exec.php file due to a lack of CSRF protection. This could allow an attacker to trick the administrator into executing arbitrary code or adding a staff entry via a crafted HTML page.

Recommendations For Sourcecodester Restaurant Management System version 1.0, consider implementing CSRF protection mechanisms to prevent attackers from tricking administrators into executing unwanted actions. As a temporary workaround, restrict access to the admin/staff-exec.php file to minimize the risk of exploitation.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2019-18414

Produtos afetados

Sourcecodester Restaurant Management System

Referências · 3

• 🔥 https://sevenlayers.com/index.php/263-restaurant-management-system-csrf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-18414 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-18414 · Aviso do Fabricante