CVE-2023-50863: critical vulnerability in Kashipara Group Travel Website
Travel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi)
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.8epss 0.7%
Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'hotelIDHidden' parameter of the generateReceipt.php resource does not validate the characters received and they are sent unfiltered to the database.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Kashipara Group · Travel WebsiteRelated CVEs — Kashipara Group Travel Website
In the same product, most dangerous first.
CVE-2023-50867CRITICALTravel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi)EPSS 0.7%CVE-2023-50866CRITICALTravel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi)EPSS 0.7%CVE-2023-50865CRITICALTravel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi)EPSS 0.7%CVE-2023-50864CRITICALTravel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi)EPSS 0.7%CVE-2023-50862CRITICALTravel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi)EPSS 0.7%