CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2024-10413 – SourceCodester Online Hotel Reservation System update.php upload unrestricted upload
https://notcve.org/view.php?id=CVE-2024-10413
A vulnerability, which was classified as critical, has been found in SourceCodester Online Hotel Reservation System 1.0. Affected by this issue is the function upload of the file /guest/update.php. The manipulation of the argument image leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. • https://github.com/K1nako0/tmp_vuln11/blob/main/README.md https://vuldb.com/?ctiid.281954 https://vuldb.com/?id.281954 https://vuldb.com/?submit.431595 https://www.sourcecodester.com • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2024-10411 – SourceCodester Online Hotel Reservation System controller.php doCheckout sql injection
https://notcve.org/view.php?id=CVE-2024-10411
A vulnerability was found in SourceCodester Online Hotel Reservation System 1.0. It has been classified as critical. Affected is the function doCancelRoom/doCancel/doConfirm/doCancel/doCheckin/doCheckout of the file /marimar/admin/mod_room/controller.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. • https://github.com/K1nako0/tmp_vuln10/blob/main/README.md https://vuldb.com/?ctiid.281940 https://vuldb.com/?id.281940 https://vuldb.com/?submit.431586 https://www.sourcecodester.com • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 2CVE-2024-10410 – SourceCodester Online Hotel Reservation System controller.php upload unrestricted upload
https://notcve.org/view.php?id=CVE-2024-10410
A vulnerability classified as critical was found in SourceCodester Online Hotel Reservation System 1.0. Affected by this vulnerability is the function upload of the file /admin/mod_room/controller.php?action=add. The manipulation of the argument image leads to unrestricted upload. The attack can be launched remotely. • https://github.com/K1nako0/CVE-2024-10410 https://github.com/K1nako0/tmp_vuln9/blob/main/README.md https://vuldb.com/?ctiid.281953 https://vuldb.com/?id.281953 https://vuldb.com/?submit.431502 https://www.sourcecodester.com • CWE-434: Unrestricted Upload of File with Dangerous Type •