PT-2021-11141 · Unknown · Booking Core - Ultimate Booking System

Published 2021-07-14 · Updated 2021-12-10 · CVE-2020-25444

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Booking Core - Ultimate Booking System version 1.7.0

Description: A Cross Site Scripting (XSS) issue exists, allowing potential exploitation through several fields and sections, including the "About Yourself” section under the “My Profile” page, the “Hotel Policy” field under the “Hotel Details” page, the “Pricing code” and “name” fields under the “Manage Tour” page, and all the labels under the “Menu” section.

Recommendations: For Booking Core - Ultimate Booking System version 1.7.0, consider restricting user input in the identified fields to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the vulnerable fields in the "My Profile", "Hotel Details", "Manage Tour", and "Menu" sections.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-25444

Affected Products

Booking Core - Ultimate Booking System

References · 4

• 🔥 https://medium.com/@singh.satyam158/vulnerabilities-in-booking-core-1-7-d85d1dfae44e · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-25444 · Security Note
• https://osv.dev/vulnerability/CVE-2020-25444 · Vendor Advisory
• https://medium.com/%40singh.satyam158/vulnerabilities-in-booking-core-1-7-d85d1dfae44e · Note