PT-2024-34597 · Unknown · Travel Management System

Anirudh Krishnaprasad · Published 2024-11-04 · Updated 2024-11-04 · CVE-2024-51328

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Travel Management System version 1.0

Description The issue allows a remote attacker to inject arbitrary code via the t2 parameter in the addcategory.php file. This enables the attacker to execute malicious scripts on the victim's browser, potentially leading to unauthorized actions or data theft.

Recommendations For Travel Management System version 1.0, consider disabling access to the addcategory.php file or restricting the use of the t2 parameter until a patch is available. As a temporary workaround, avoid using the t2 parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-51328

Affected Products

Travel Management System

References · 7

• 🔥 https://github.com/redtrib3/CVEs/tree/main/CVE-2024-51328%20-%20Stored%20XSS%20 · Exploit
• https://osv.dev/vulnerability/CVE-2024-51328 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-51328 · Security Note
• https://t.me/cvedetector/9771 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1853584482059567121 · Twitter Post
• https://twitter.com/CVEnew/status/1853495259004543186 · Twitter Post
• https://projectworlds.in · Note