PT-2023-24903 · Unknown · Itsourcecode Online Hotel Management System Project In Php

Junyanyip · Published 2023-06-29 · Updated 2023-07-06 · CVE-2023-34486

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions itsourcecode Online Hotel Management System Project In PHP version 1.0.0

Description The issue allows for Cross Site Scripting (XSS) and potentially remote code execution by entering malicious code in the date selection box. This can be exploited to execute unauthorized code on the system.

Recommendations For itsourcecode Online Hotel Management System Project In PHP version 1.0.0, consider removing or restricting the ability to enter custom code in the date selection box until a proper fix is available. As a temporary workaround, restrict access to the date selection functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-34486

Affected Products

Itsourcecode Online Hotel Management System Project In Php

References · 4

• 🔥 https://github.com/JunyanYip/itsourcecode_justines_xss_vul · Exploit
• https://osv.dev/vulnerability/CVE-2023-34486 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-34486 · Security Note
• https://t.me/cibsecurity/65722 · Telegram Post