Paper/Archive/CVE-2024-3347

CVE-2024-3347

SourceCodester Airline Ticket Reservation System — SourceCodester Airline Ticket Reservation System activate_jet_details_form_handler.php sql injection

EPSS 0.9%public exploit CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 58.6.586 × 2011.7 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

A vulnerability was found in SourceCodester Airline Ticket Reservation System 1.0. It has been rated as critical. This issue affects some unknown processing of the file activate_jet_details_form_handler.php. The manipulation of the argument jet_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259451.

Affected

ProductAffectedFixed inSource

Airline Ticket Reservation System1.0–CNA

airline_ticket_reservation_system1.0–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

VulDB (CNA)7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

VulDB (CNA)7.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

writeupvuldb.com/?id.259451 refvuldb.com/?ctiid.259451 writeupvuldb.com/?submit.310184 exploitgithub.com/thisissuperann/Vul/blob/main/Airline-Ticket-Reservation-System-01.md