SourceCodester Online Flight Booking Management System judge_panel.php sql injection
CVE-2023-0281

6.3MEDIUM

Key Information:

Vendor: Sourcecodester
Status: Online Flight Booking Management System
Vendor: CVE Published:; 13 January 2023

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A vulnerability has been identified in the SourceCodester Online Flight Booking Management System, specifically related to the file judge_panel.php. This issue stems from improper handling of the argument subevent_id, leading to a SQL injection vulnerability. Attackers can exploit this weakness remotely to manipulate database queries. Given that this exploit has been publicly disclosed, it poses a significant risk, and users of the affected system should take immediate action to mitigate potential threats.

Affected Version(s)

Online Flight Booking Management System

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2023-0281 - Proof of Concept

References

https://vuldb.com/?id.218276

vdb-entrytechnical-description

https://vuldb.com/?ctiid.218276

signaturepermissions-required

https://github.com/qyhmsys/cve-list/blob/master/Online%20...

exploit

CVSS V3.1

Score:

6.3

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

CVSS V3.0