PT-2024-15481 · Codeastro · Codeastro Vehicle Booking System

Vipindas · Published 2024-01-09 · Updated 2024-05-17 · CVE-2024-0345

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CodeAstro Vehicle Booking System version 1.0

Description A problematic issue was found in the User Registration component, specifically in the file usr/usr-register.php. The manipulation of the Full Name, Last Name, or Address arguments with malicious input, such as <script>alert(document.cookie)</script>, leads to cross-site scripting. This issue can be exploited remotely.

Recommendations For CodeAstro Vehicle Booking System version 1.0, consider disabling the User Registration component, specifically the file usr/usr-register.php, until a patch is available. Restrict access to the usr/usr-register.php file to minimize the risk of exploitation. Avoid using the Full Name, Last Name, and Address arguments in the affected component until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-0345

Affected Products

Codeastro Vehicle Booking System

References · 6

• 🔥 https://drive.google.com/file/d/1ihxLw4kzbAbDhHtca3UnTaB-iMWHi5DJ/view?usp=sharing · Exploit
• https://osv.dev/vulnerability/CVE-2024-0345 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0345 · Security Note
• https://vuldb.com/?id.250113 · Note
• https://vuldb.com/?ctiid.250113 · Note
• https://twitter.com/CVEnew/status/1744845485511524793 · Twitter Post