PT-2023-24903 · Unknown · Itsourcecode Online Hotel Management System Project In Php

Junyanyip · Publicado 2023-06-29 · Atualizado 2023-07-06 · CVE-2023-34486

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions itsourcecode Online Hotel Management System Project In PHP version 1.0.0

Description The issue allows for Cross Site Scripting (XSS) and potentially remote code execution by entering malicious code in the date selection box. This can be exploited to execute unauthorized code on the system.

Recommendations For itsourcecode Online Hotel Management System Project In PHP version 1.0.0, consider removing or restricting the ability to enter custom code in the date selection box until a proper fix is available. As a temporary workaround, restrict access to the date selection functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-34486

Produtos afetados

Itsourcecode Online Hotel Management System Project In Php

Referências · 4

• 🔥 https://github.com/JunyanYip/itsourcecode_justines_xss_vul · Exploit
• https://t.me/cibsecurity/65722 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-34486 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-34486 · Nota de Segurança