PT-2024-30139 · Unknown · Kashipara Hotel Management System

Published 2024-08-22 · Updated 2024-08-23 · CVE-2024-42769

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kashipara Hotel Management System version 1.0

Description A Reflected Cross Site Scripting (XSS) issue was found in the "/core/signup user.php" endpoint of the system, allowing remote attackers to execute arbitrary code via the user fname and user lname parameters. This could enable malicious scripts to hijack user sessions.

Recommendations For Kashipara Hotel Management System version 1.0, patch and validate user input as soon as possible to prevent attacks. As a temporary workaround, consider restricting access to the "/core/signup user.php" endpoint or validating and sanitizing the user fname and user lname parameters to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-42769

Affected Products

Kashipara Hotel Management System

References · 8

• 🔥 https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Hotel%20Management%20System%20v1.0/Reflected%20XSS%20-%20Sign%20UP.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-42769 · Security Note
• https://osv.dev/vulnerability/CVE-2024-42769 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1826697942868107376 · Twitter Post
• https://kashipara.com · Note
• https://twitter.com/oktsec/status/1826669261147803820 · Twitter Post
• https://twitter.com/CVEnew/status/1826645459730915524 · Twitter Post
• https://t.me/cvedetector/3932 · Telegram Post