PT-2023-17098 · Sourcecodester · Sourcecodester Online Tours & Travels Management System

Xiaoliang · Publicado 2023-03-23 · Atualizado 2024-05-17 · CVE-2023-1589

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SourceCodester Online Tours & Travels Management System version 1.0

Description A critical issue has been found in the system, affecting the exec function of the file admin/operations/approve delete.php. The manipulation of the id argument leads to SQL injection. The attack can be initiated remotely.

Recommendations For SourceCodester Online Tours & Travels Management System version 1.0, consider disabling the exec function in the admin/operations/approve delete.php file until a patch is available. Restrict access to the approve delete.php file to minimize the risk of exploitation. Avoid using the id argument in the affected function until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-1589

Produtos afetados

Sourcecodester Online Tours & Travels Management System

Referências · 7

• 🔥 https://blog.csdn.net/weixin_43864034/article/details/129729911 · Exploit
• https://osv.dev/vulnerability/CVE-2023-1589 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-1589 · Nota de Segurança
• https://t.me/cibsecurity/60543 · Publicação no Telegram
• https://vuldb.com/?ctiid.223654 · Nota
• https://t.me/cvenotify/46703 · Publicação no Telegram
• https://vuldb.com/?id.223654 · Nota