PT-2024-16206 · Sourcecodester · Best House Rental Management System

Willdone1 · Published 2024-10-24 · Updated 2024-10-30 · CVE-2024-10348

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SourceCodester Best House Rental Management System version 1.0

Description A vulnerability was found in the Manage Tenant Details component, specifically affecting the /index.php?page=tenants file. The issue arises from the manipulation of the Last Name, First Name, and Middle Name arguments, leading to cross-site scripting. This can be initiated remotely. The exploit has been disclosed publicly and may be used. Initially, only the "Last Name" field was identified as affected, but other fields might also be vulnerable.

Recommendations For version 1.0, consider disabling the manipulation of the Last Name, First Name, and Middle Name arguments in the /index.php?page=tenants file as a temporary workaround until a patch is available. Restrict access to the Manage Tenant Details component to minimize the risk of exploitation. Avoid using the affected fields in the component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-10348

Affected Products

Best House Rental Management System

References · 10

• 🔥 https://github.com/will121351/wenqin.webray.com.cn/blob/main/CVE-project/house-rental-management-system.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-10348 · Security Note
• https://osv.dev/vulnerability/CVE-2024-10348 · Vendor Advisory
• https://t.me/cvedetector/8875 · Telegram Post
• https://vuldb.com/?id.281697 · Note
• https://t.me/cvenotify/100010 · Telegram Post
• https://vuldb.com/?ctiid.281697 · Note
• https://vuldb.com/?submit.427471 · Note
• https://t.me/cvenotify/99444 · Telegram Post
• https://sourcecodester.com · Note