PT-2024-16257 · Sourcecodester · Sourcecodester Online Hotel Reservation System

K1Nako · Published 2024-10-27 · Updated 2024-10-29 · CVE-2024-10413

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SourceCodester Online Hotel Reservation System version 1.0

Description A critical issue has been found in the function upload of the file /guest/update.php, where the manipulation of the image argument leads to unrestricted upload. This issue can be exploited remotely. The exploit has been disclosed to the public and may be used.

Recommendations For SourceCodester Online Hotel Reservation System version 1.0, consider disabling the upload function in /guest/update.php to prevent unrestricted file uploads until a patch is available. Restrict access to the /guest/update.php file to minimize the risk of exploitation. Avoid using the image argument in the affected function until the issue is resolved.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-10413

Affected Products

Sourcecodester Online Hotel Reservation System

References · 9

• 🔥❌ https://github.com/K1nako0/tmp_vuln11/blob/main/README.md · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2024-10413 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10413 · Security Note
• https://t.me/cvenotify/99635 · Telegram Post
• https://vuldb.com/?ctiid.281954 · Note
• https://sourcecodester.com · Note
• https://vuldb.com/?id.281954 · Note
• https://t.me/cvedetector/9052 · Telegram Post
• https://vuldb.com/?submit.431595 · Note