PT-2024-15888 · Unknown · Sourcecodester Online Tours & Travels Management System

Hanchao

·

Published

2024-01-25

·

Updated

2024-05-17

·

CVE-2024-0883

CVSS v2.0
6.5
VectorAV:N/AC:L/Au:S/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions SourceCodester Online Tours & Travels Management System version 1.0
Description A critical issue was found in the system, affecting the 
prepare
function of the 
admin/pay.php
file. The manipulation of the 
id
argument leads to SQL injection. This issue can be initiated remotely.
Recommendations For SourceCodester Online Tours & Travels Management System version 1.0, as a temporary workaround, consider restricting access to the 
admin/pay.php
file or disabling the 
prepare
function until a patch is available. Avoid using the 
id
argument in the affected function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-0883

Affected Products

Sourcecodester Online Tours & Travels Management System