PT-2020-17111 · Unknown · Car Rental Management System

Oretnom23 · Published 2020-12-14 · Updated 2023-10-27 · CVE-2020-29227

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Car Rental Management System version 1.0

Description An issue was discovered in the Car Rental Management System where an unauthenticated user can perform a file inclusion attack against the "/index.php" file with a partial filename in the page parameter. This can cause local file inclusion, resulting in code execution.

Recommendations For Car Rental Management System version 1.0, as a temporary workaround, consider restricting access to the /index.php file or validating and sanitizing the page parameter to prevent malicious input. Additionally, avoid using partial filenames in the page parameter until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2020-29227

Affected Products

Car Rental Management System

References · 6

• 🔥 https://loopspell.medium.com/cve-2020-29227-unauthenticated-local-file-inclusion-7d3bd2c5c6a5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-29227 · Security Note
• https://osv.dev/vulnerability/CVE-2020-29227 · Vendor Advisory
• https://twitter.com/NDumbblonde/status/1717903633595900330 · Twitter Post
• https://t.me/cibsecurity/20735 · Telegram Post
• https://sourcecodester.com/php/14544/car-rental-management-system-using-phpmysqli-source-code.html · Note