critical9.1Public exploit code
CVE-2020-25762
An issue was discovered in SourceCodester Seat Reservation System 1.0.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Seat Reservation System 1.0 - Unauthenticated SQL Injection2020-10-16 · webapps · php
Impact
An issue was discovered in SourceCodester Seat Reservation System 1.0. The file admin_class.php does not perform input validation on the username and password parameters. An attacker can send malicious input in the post request to /admin/ajax.php?action=login and bypass authentication, extract sensitive information etc.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Seat Reservation System Project | Seat Reservation System | Version 1.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/159261/Seat-Reservation-System-1.0-SQL-Injection.html
- http://seclists.org/fulldisclosure/2020/Sep/42
- https://packetstormsecurity.com/files/author/15149
- http://packetstormsecurity.com/files/159261/Seat-Reservation-System-1.0-SQL-Injection.html
- http://seclists.org/fulldisclosure/2020/Sep/42
- https://packetstormsecurity.com/files/author/15149