Paper/Archive/CVE-2024-3349

CVE-2024-3349

SourceCodester Aplaya Beach Resort Online Reservation System — SourceCodester Aplaya Beach Resort Online Reservation System login.php sql injection

EPSS 0.9%public exploit CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 58.2.582 × 2011.6 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

A vulnerability classified as critical was found in SourceCodester Aplaya Beach Resort Online Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/login.php. The manipulation of the argument email leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259453 was assigned to this vulnerability.

Affected

ProductAffectedFixed inSource

Aplaya Beach Resort Online Reservation System1.0–CNA

aplaya_beach_resort_online_reservation_system1.0–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

VulDB (CNA)7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

VulDB (CNA)7.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

writeupvuldb.com/?id.259453 refvuldb.com/?ctiid.259453 writeupvuldb.com/?submit.310217 exploitgithub.com/qqqyc/vlun1/blob/main/Aplaya-Beach-Resort-Online-Reservation-System-02