CVE-2020-25762 — CRITICAL (9.1)

Vulnerability Description

An issue was discovered in SourceCodester Seat Reservation System 1.0. The file admin_class.php does not perform input validation on the username and password parameters. An attacker can send malicious input in the post request to /admin/ajax.php?action=login and bypass authentication, extract sensitive information etc.

CVSS Score

9.1

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Seat Reservation System Project	Seat Reservation System	1.0

Related Weaknesses (CWE)

CWE-89

References

http://packetstormsecurity.com/files/159261/Seat-Reservation-System-1.0-SQL-InjeExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2020/Sep/42ExploitMailing ListThird Party Advisory
https://packetstormsecurity.com/files/author/15149Third Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/159261/Seat-Reservation-System-1.0-SQL-InjeExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2020/Sep/42ExploitMailing ListThird Party Advisory
https://packetstormsecurity.com/files/author/15149Third Party AdvisoryVDB Entry

FAQ

What is CVE-2020-25762?

CVE-2020-25762 is a vulnerability with a CVSS score of 9.1 (CRITICAL). An issue was discovered in SourceCodester Seat Reservation System 1.0. The file admin_class.php does not perform input validation on the username and password parameters. An attacker can send maliciou...

How severe is CVE-2020-25762?

CVE-2020-25762 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2020-25762?

Check the references section above for vendor advisories and patch information. Affected products include: Seat Reservation System Project Seat Reservation System.