Critical severity · published Jan 4, 2024
CVE-2023-50864
Travel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi)
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'hotelId' parameter of the hotelDetails.php resource does not validate the characters received and they are sent unfiltered to the database.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TW
Travel Website · Kashipara Group
1.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-50864
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-50864
Exploit
https://fluidattacks.com/advisories/evans/
Product
https://www.kashipara.com/
More from Travel Website
9.8
CVE-2023-50867
Travel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi)
9.8
CVE-2023-50866
Travel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi)
9.8
CVE-2023-50865
Travel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi)
9.8
CVE-2023-50863
Travel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi)
9.8
CVE-2023-50862
Travel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi)