High severity · published Jul 11, 2024
CVE-2024-1845
VikRentCar Car Rental Management System < 1.3.2 - Cross Site Request Forgery
8.8
CVSS
0.3%
EPSS
No
On KEV
Description
The VikRentCar Car Rental Management System WordPress plugin before 1.3.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VC
VikRentCar Car Rental Management System ·
before 1.3.2 · source: vendor, CISA
VI
Vikrentcar · E4jconnect
before 1.3.2 · source: NVD
Affected product
VC
VikRentCar Car Rental Management System
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-1845
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-1845
Exploit
https://wpscan.com/vulnerability/a8d7b564-36e0-4f05-9b49-1b441f453d0a/
More from VikRentCar Car Rental Management System
4.8
CVE-2021-24519
Vik Rent Car < 1.1.10 - Authenticated Stored Cross-Site Scripting (XSS)