Medium severity · published Aug 18, 2024
CVE-2024-7912
CodeAstro Online Railway Reservation System assets exposure of information through directory listing
5.3
CVSS
0.8%
EPSS
No
On KEV
Description
A vulnerability was found in CodeAstro Online Railway Reservation System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/assets/. The manipulation leads to exposure of information through directory listing. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OR
Online Railway Reservation System · CodeAstro
1.0 · source: vendor, NVD, CISA
Affected product
OR
Online Railway Reservation System
CodeAstro
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-7912
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-7912
Exploit
https://github.com/CYB84/CVE_Writeup/blob/main/Online%20Railway%20Reservation%20System/Directory%20Listing.md
Permissions Required
https://vuldb.com/?ctiid.275038
Third Party Advisory
https://vuldb.com/?id.275038
Third Party Advisory
https://vuldb.com/?submit.391658
More from Online Railway Reservation System
7.2
CVE-2024-7910
CodeAstro Online Railway Reservation System Profile Photo Update emp-profile-avatar.php unrestricted upload
6.1
CVE-2024-0782
CodeAstro Online Railway Reservation System pass-profile.php cross site scripting
4.8
CVE-2024-7815
CodeAstro Online Railway Reservation System Update Employee Page admin-update-employee.php cross site scripting
4.8
CVE-2024-7814
CodeAstro Online Railway Reservation System Add Employee Page admin-add-employee.php cross site scripting