PT-2021-22287 · Unknown · Online Catering Reservation System

Nu11Secur1Ty · Published 2021-08-16 · Updated 2021-09-21 · CVE-2021-38758

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Online Catering Reservation System version 1.0

Description The issue is related to a directory traversal vulnerability due to a lack of validation in the index.php file. This allows for potential unauthorized access to sensitive files and directories.

Recommendations For Online Catering Reservation System version 1.0, consider validating user input in the index.php file to prevent directory traversal attacks. As a temporary workaround, restrict access to sensitive files and directories until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-38758

Affected Products

Online Catering Reservation System

References · 13

• 🔥 https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-38758 · Exploit
• 🔥 https://github.com/nu11secur1ty/CVE-mitre/blob/main/CVE-2021-38758/README.MD · Exploit
• 🔥 https://github.com/nu11secur1ty/CVE-mitre/tree/main/Online-Catering-Reservation-DT-Food-Catering · Exploit
• 🔥 https://github.com/dumpling-soup/Online-Catering-Reservation-DT/blob/main/README.md · Exploit
• https://osv.dev/vulnerability/CVE-2021-38758 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38758 · Security Note
• https://t.me/cvenotify/21242 · Telegram Post
• https://attackerkb.com/topics/XuEb81tsid/online-catering-reservation-dt-food-catering-by-oretnom23-v1-0-sql-injection---login · Note
• https://t.me/cvenotify/20244 · Telegram Post
• https://t.me/cvenotify/19422 · Telegram Post
• https://t.me/cvenotify/20425 · Telegram Post
• https://t.me/cvenotify/19440 · Telegram Post
• https://t.me/cibsecurity/27386 · Telegram Post