PT-2020-16188 · Sourcecodester · Sourcecodester Resort Reservation System

Ava Tester One · Published 2020-09-22 · Updated 2020-10-08 · CVE-2020-25762

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions SourceCodester Seat Reservation System version 1.0

Description The issue concerns a lack of input validation on the username and password parameters in the admin class.php file. This allows an attacker to send malicious input in the POST request to "/admin/ajax.php?action=login" and potentially bypass authentication or extract sensitive information.

Recommendations For SourceCodester Seat Reservation System version 1.0, consider implementing input validation on the username and password parameters in the admin class.php file to prevent malicious input. As a temporary workaround, restrict access to the "/admin/ajax.php?action=login" endpoint to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-25762

Affected Products

Sourcecodester Resort Reservation System

References · 7

• 🔥 http://packetstormsecurity.com/files/159261/Seat-Reservation-System-1.0-SQL-Injection.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2020/Sep/42 · Exploit
• 🔥 https://exploit-db.com/exploits/48889 · Exploit
• https://osv.dev/vulnerability/CVE-2020-25762 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25762 · Security Note
• https://t.me/defcon_news/57608 · Telegram Post
• https://packetstormsecurity.com/files/author/15149 · Note