PT-2023-28830 · Unknown · Resort Reservation System

Samarth Dad · Publicado 2023-09-25 · Atualizado 2024-09-25 · CVE-2023-43458

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Resort Reservation System version 1.0

Description A Cross Site Scripting (XSS) issue allows a remote attacker to execute arbitrary code and obtain sensitive information via the room, name, and description parameters in the manage room function. This enables the attacker to potentially access and manipulate sensitive data.

Recommendations For Resort Reservation System version 1.0, as a temporary workaround, consider disabling the manage room function until a patch is available. Restrict access to the parameters room, name, and description to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-43458

Produtos afetados

Resort Reservation System

Referências · 7

• 🔥 https://samh4cks.github.io/posts/cve-2023-43458 · Exploit
• https://osv.dev/vulnerability/CVE-2023-43458 · Aviso do Fabricante
• https://t.me/cibsecurity/71024 · Publicação no Telegram
• https://sourcecodester.com/php/16447/resort-reservation-system-php-and-sqlite3-source-code-free-download.html · Nota
• https://twitter.com/VulmonFeeds/status/1706437940702834691 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-43458 · Nota de Segurança
• https://twitter.com/CVEnew/status/1706402469918712253 · Publicação no Twitter