PT-2024-38679 · Unknown · Codeastro Online Railway Reservation System

Raj Nandi · Published 2024-08-18 · Updated 2024-08-19 · CVE-2024-7912

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions CodeAstro Online Railway Reservation System version 1.0

Description A vulnerability was found in the system, affecting unknown code of the file /admin/assets/. The manipulation leads to exposure of information through directory listing. The attack can be initiated remotely. Implementing strict firewall rules to protect /admin/assets/ is recommended to minimize the risk of unauthorized access.

Recommendations For CodeAstro Online Railway Reservation System version 1.0, implement strict firewall rules to protect the /admin/assets/ directory until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-548

Related Identifiers

CVE-2024-7912

Affected Products

Codeastro Online Railway Reservation System

References · 10

• 🔥 https://github.com/CYB84/CVE_Writeup/blob/main/Online%20Railway%20Reservation%20System/Directory%20Listing.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-7912 · Security Note
• https://osv.dev/vulnerability/CVE-2024-7912 · Vendor Advisory
• https://t.me/cvedetector/3478 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1825347713463992585 · Twitter Post
• https://twitter.com/CVEnew/status/1825289409190654092 · Twitter Post
• https://vuldb.com/?ctiid.275038 · Note
• https://vuldb.com/?id.275038 · Note
• https://vuldb.com/?submit.391658 · Note
• https://twitter.com/oktsec/status/1825566974480421158 · Twitter Post