Paper/Archive/CVE-2023-45019

CVE-2023-45019

Projectworlds Pvt. Limited Online Bus Booking System — Online Bus Booking System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)

EPSS 0.7%public exploit CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 53.2.532 × 2010.6 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'category' parameter of the category.php resource does not validate the characters received and they are sent unfiltered to the database.

Affected

ProductAffectedFixed inSource

Online Bus Booking System1.0–CNA

online_bus_booking_system1.0–CISA-ADP

Scores by source

Fluid Attacks (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

writeupfluidattacks.com/advisories/oconnor refprojectworlds.in