PT-2023-29355 · Unknown · Online Bus Booking System

Publicado 2023-11-02 · Atualizado 2024-01-02 · CVE-2023-45014

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Online Bus Booking System version 1.0

Description The issue concerns multiple Unauthenticated SQL Injection vulnerabilities. Specifically, the bus id parameter of the "bus info.php" resource does not validate the characters received and they are sent unfiltered to the database.

Recommendations For Online Bus Booking System version 1.0, consider validating and filtering the bus id parameter in the "bus info.php" resource to prevent SQL injection attacks. As a temporary workaround, restrict access to the "bus info.php" resource until a patch is available.

Exploit

Identificadores relacionados

CVE-2023-45014

Produtos afetados

Online Bus Booking System

Referências · 4

• 🔥 https://fluidattacks.com/advisories/oconnor · Exploit
• https://t.me/cibsecurity/73404 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-45014 · Nota de Segurança
• https://twitter.com/cracbot/status/1720381852467253699 · Publicação no Twitter