PT-2023-16702 · Sourcecodester · Sourcecodester Online Hotel Reservation System

Jidle · Publicado 2023-02-24 · Atualizado 2025-04-03 · CVE-2023-1030

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SourceCodester Online Boat Reservation System version 1.0

Description A vulnerability has been found in the file /boat/login.php of the component POST Parameter Handler. The manipulation of the argument un leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Recommendations For SourceCodester Online Boat Reservation System version 1.0, consider disabling the un argument in the /boat/login.php file as a temporary workaround until a patch is available. Restrict access to the POST Parameter Handler component to minimize the risk of exploitation. Avoid using the un argument in the affected API endpoint until the issue is resolved.

Exploit

Correção

Code Injection

XSS

Enumeração de Fraquezas

CWE-94

CWE-79

Identificadores relacionados

CVE-2023-1030

Produtos afetados

Sourcecodester Online Hotel Reservation System

Referências · 8

• 🔥❌ https://github.com/jidle123/bug_report/blob/main/vendors/winex01/Online%20Boat%20Reservation%20System/XSS-1.md#online-boat-reservation-system-v10-by-winex01-has-cross-site-scripting-reflected · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2023-1030 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-1030 · Aviso do Fabricante
• https://t.me/cibsecurity/58891 · Publicação no Telegram
• https://vuldb.com/?submit.94112 · Nota
• https://vuldb.com/?id.221755 · Nota
• https://t.me/cvenotify/117532 · Publicação no Telegram
• https://vuldb.com/?ctiid.221755 · Nota