PT-2024-30011 · Unknown · Hotel Management System

Topsky979 · Published 2024-08-20 · Updated 2024-08-23 · CVE-2024-42552

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Hotel Management System version 91caab8

Description A SQL injection vulnerability was discovered in the Hotel Management System via the book id parameter at the "admin room history.php" endpoint. This issue allows for potential unauthenticated remote exploitation. Administrators should review logs for signs of compromise.

Recommendations For Hotel Management System version 91caab8, consider disabling access to the "admin room history.php" endpoint until a patch is available. Restrict the use of the book id parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-42552

Affected Products

Hotel Management System

References · 8

• 🔥 https://gist.github.com/topsky979/2386856df3f3ffa7bdc4738e24da4af3 · Exploit
• https://osv.dev/vulnerability/CVE-2024-42552 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42552 · Security Note
• https://twitter.com/oktsec/status/1825899165668241752 · Twitter Post
• https://twitter.com/CVEnew/status/1825885266869105102 · Twitter Post
• https://twitter.com/cracbot/status/1827224483553480869 · Twitter Post
• https://t.me/cvenotify/91255 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1825907178772791695 · Twitter Post