PT-2023-16702 · Sourcecodester · Sourcecodester Online Hotel Reservation System

Jidle · Published 2023-02-24 · Updated 2025-04-03 · CVE-2023-1030

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SourceCodester Online Boat Reservation System version 1.0

Description A vulnerability has been found in the file /boat/login.php of the component POST Parameter Handler. The manipulation of the argument un leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Recommendations For SourceCodester Online Boat Reservation System version 1.0, consider disabling the un argument in the /boat/login.php file as a temporary workaround until a patch is available. Restrict access to the POST Parameter Handler component to minimize the risk of exploitation. Avoid using the un argument in the affected API endpoint until the issue is resolved.

Exploit

Fix

Code Injection

XSS

Weakness Enumeration

CWE-94

CWE-79

Related Identifiers

CVE-2023-1030

Affected Products

Sourcecodester Online Hotel Reservation System

References · 8

• 🔥❌ https://github.com/jidle123/bug_report/blob/main/vendors/winex01/Online%20Boat%20Reservation%20System/XSS-1.md#online-boat-reservation-system-v10-by-winex01-has-cross-site-scripting-reflected · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2023-1030 · Security Note
• https://osv.dev/vulnerability/CVE-2023-1030 · Vendor Advisory
• https://t.me/cibsecurity/58891 · Telegram Post
• https://vuldb.com/?submit.94112 · Note
• https://vuldb.com/?id.221755 · Note
• https://t.me/cvenotify/117532 · Telegram Post
• https://vuldb.com/?ctiid.221755 · Note