Lucene search

Fluid AttacksVULNRICHMENT:CVE-2023-49271

HistoryDec 20, 2023 - 7:24 p.m.

CVE-2023-49271 Hotel Management v1.0 - Multiple Reflected Cross-Site Scripting (XSS)

2023-12-2019:24:15

CWE-79

Fluid Attacks

github.com

hotel management v1.0

cross-site scripting

reflected

reservation.php

check out date vulnerability

html document

plain text

application response

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

AI Score

6.4

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Hotel Management v1.0 is vulnerable to multiple authenticated Reflected Cross-Site Scripting vulnerabilities. The ‘check_out_date’ parameter of the reservation.php resource is copied into the HTML document as plain text between tags. Any input is echoed unmodified in the application’s response.

References

fluidattacks.com/advisories/lang/

www.kashipara.com/

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

AI Score

6.4

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2023-49271