PT-2015-6675 · Apphp · Apphp Hotel Site

Published 2015-06-22 · Updated 2016-12-07 · CVE-2015-4713

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ApPHP Hotel Site versions 3.x.x

Description The issue allows remote editors to execute arbitrary SQL commands. This is achieved via the pid parameter to the "index.php" endpoint.

Recommendations For ApPHP Hotel Site versions 3.x.x, avoid using the pid parameter in the "index.php" endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2015-4713

Affected Products

Apphp Hotel Site

References · 3

• 🔥 http://packetstormsecurity.com/files/132369/ApPHP-Hotel-Site-3.x.x-SQL-Injection.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-4713 · Security Note
• http://securityfocus.com/bid/75390 · Note