Cross-Site Scripting Vulnerability in Online Ticket Booking by Unknown Vendor
CVE-2018-5074

4.8MEDIUM

Key Information:

Vendor: Advanced Real Estate Script Project
Status: Advanced Real Estate Script
Vendor: CVE Published:; 3 January 2018

🔔 Create Advanced Real Estate Script Project Vulnerability Alert

What is CVE-2018-5074?

An XSS vulnerability in the Online Ticket Booking system allows attackers to exploit the admin/manageownerlist.php contact parameter, potentially enabling them to execute arbitrary scripts in the context of an authenticated administrator session. This could lead to unauthorized actions being performed on behalf of the admin, compromising the security of the entire application and its users.

References

https://github.com/d4wner/Vulnerabilities-Report/blob/mas...

x_refsource_MISC

CVSS V3.1

Score:

4.8

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

High

User Interaction:

Required

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability Reserved
Oct 3, 2022
Vulnerability published
Jan 3, 2018

CVE-2018-5074 Data

JSON