Sql injection

2024-01-0415:15:00

PRIOn knowledge base

www.prio-n.com

sql injection

unauthenticated

travel website v1.0

generatereceipt.php

database

8.6 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

33.0%

JSON

Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘hotelIDHidden’ parameter of the generateReceipt.php resource does not validate the characters received and they are sent unfiltered to the database.

CPENameOperatorVersion
travel_websiteeq1.0

CPE	Name	Operator	Version
	travel_website	eq	1.0

References

fluidattacks.com/advisories/evans/

www.kashipara.com/