Paper/Archive/CVE-2024-3355

CVE-2024-3355

SourceCodester Aplaya Beach Resort Online Reservation System — SourceCodester Aplaya Beach Resort Online Reservation System sql injection

EPSS 0.9%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 59.6.596 × 2011.9 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A vulnerability was found in SourceCodester Aplaya Beach Resort Online Reservation System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file admin/mod_users/controller.php?action=add. The manipulation of the argument name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259459.

Affected

ProductAffectedFixed inSource

Aplaya Beach Resort Online Reservation System1.0–CNA

aplaya_beach_resort_online_reservation_system1.0–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

VulDB (CNA)7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

VulDB (CNA)7.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

writeupvuldb.com/?id.259459 refvuldb.com/?ctiid.259459 writeupvuldb.com/?submit.310224 exploitgithub.com/qqqyc/vlun1/blob/main/Aplaya-Beach-Resort-Online-Reservation-System-09