PT-2023-23537 · Unknown · Online Travel Agency System

Dilillearngent · Publicado 2023-08-17 · Atualizado 2024-10-07 · CVE-2023-31939

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Online Travel Agency System version 1.0

Description A SQL injection issue allows a remote attacker to execute arbitrary code via the costomer id parameter at the "customer edit.php" endpoint. This enables the attacker to manipulate database queries, potentially leading to unauthorized data access or modification.

Recommendations For Online Travel Agency System version 1.0, consider disabling the costomer id parameter in the "customer edit.php" endpoint until a patch is available to prevent exploitation. Restrict access to the "customer edit.php" endpoint to minimize the risk of arbitrary code execution. Avoid using the costomer id parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-31939

Produtos afetados

Online Travel Agency System

Referências · 7

• 🔥 https://github.com/DiliLearngent/BugReport/blob/main/php/Online-Travel-Agency-System/bug4-SQL-Injection-costomer_id.md · Exploit
• https://twitter.com/CVEnew/status/1692263314930241874 · Publicação no Twitter
• https://t.me/cvenotify/56818 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-31939 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-31939 · Aviso do Fabricante
• https://t.me/cibsecurity/68789 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1692306442638757942 · Publicação no Twitter