PT-2023-23537 · Unknown · Online Travel Agency System

Dilillearngent · Published 2023-08-17 · Updated 2024-10-07 · CVE-2023-31939

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Online Travel Agency System version 1.0

Description A SQL injection issue allows a remote attacker to execute arbitrary code via the costomer id parameter at the "customer edit.php" endpoint. This enables the attacker to manipulate database queries, potentially leading to unauthorized data access or modification.

Recommendations For Online Travel Agency System version 1.0, consider disabling the costomer id parameter in the "customer edit.php" endpoint until a patch is available to prevent exploitation. Restrict access to the "customer edit.php" endpoint to minimize the risk of arbitrary code execution. Avoid using the costomer id parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-31939

Affected Products

Online Travel Agency System

References · 7

• 🔥 https://github.com/DiliLearngent/BugReport/blob/main/php/Online-Travel-Agency-System/bug4-SQL-Injection-costomer_id.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-31939 · Security Note
• https://osv.dev/vulnerability/CVE-2023-31939 · Vendor Advisory
• https://twitter.com/CVEnew/status/1692263314930241874 · Twitter Post
• https://t.me/cvenotify/56818 · Telegram Post
• https://t.me/cibsecurity/68789 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1692306442638757942 · Twitter Post