Cross-Site Scripting Vulnerability in Online Ticket Booking Software by an Unknown Vendor
CVE-2018-5072

4.8MEDIUM

Key Information:

Vendor: Advanced Real Estate Script Project
Status: Advanced Real Estate Script
Vendor: CVE Published:; 3 January 2018

🔔 Create Advanced Real Estate Script Project Vulnerability Alert

What is CVE-2018-5072?

The Online Ticket Booking software has a Cross-Site Scripting (XSS) vulnerability that can be exploited via the 'keyword' parameter in the admin/sitesettings.php file. This flaw may allow attackers to inject malicious scripts, potentially leading to unauthorized actions performed on behalf of users when they interact with the compromised application.

References

https://github.com/d4wner/Vulnerabilities-Report/blob/mas...

x_refsource_MISC

CVSS V3.1

Score:

4.8

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

High

User Interaction:

Required

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability Reserved
Oct 3, 2022
Vulnerability published
Jan 3, 2018

CVE-2018-5072 Data

JSON