CVE-2023-50862: fallo crítico en Kashipara Group Travel Website
Travel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi)
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.8epss 0.7%
Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'hotelIDHidden' parameter of the booking.php resource does not validate the characters received and they are sent unfiltered to the database.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Kashipara Group · Travel WebsiteCVEs relacionadas — Kashipara Group Travel Website
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-50867CRITICALTravel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi)EPSS 0.7%CVE-2023-50866CRITICALTravel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi)EPSS 0.7%CVE-2023-50865CRITICALTravel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi)EPSS 0.7%CVE-2023-50864CRITICALTravel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi)EPSS 0.7%CVE-2023-50863CRITICALTravel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi)EPSS 0.7%