PT-2019-15397 · Sourcecodester · Sourcecodester Restaurant Management System

Published 2019-10-24 · Updated 2019-10-28 · CVE-2019-18414

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sourcecodester Restaurant Management System version 1.0

Description The issue is related to a Cross Site Request Forgery vulnerability in the admin/staff-exec.php file due to a lack of CSRF protection. This could allow an attacker to trick the administrator into executing arbitrary code or adding a staff entry via a crafted HTML page.

Recommendations For Sourcecodester Restaurant Management System version 1.0, consider implementing CSRF protection mechanisms to prevent attackers from tricking administrators into executing unwanted actions. As a temporary workaround, restrict access to the admin/staff-exec.php file to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-18414

Affected Products

Sourcecodester Restaurant Management System

References · 3

• 🔥 https://sevenlayers.com/index.php/263-restaurant-management-system-csrf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-18414 · Security Note
• https://osv.dev/vulnerability/CVE-2019-18414 · Vendor Advisory