CVE-2020-29227

CRITICALNuclei

Car Rental Management System index.php Vulnerability

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2020-29227 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

An issue was discovered in Car Rental Management System 1.0. An unauthenticated user can perform a file inclusion attack against the /index.php file with a partial filename in the "page" parameter, to cause local file inclusion resulting in code execution.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Apr 12, 2021 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

car_rental_management_system

Browse car_rental_management_system_project / car_rental_management_system
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALCar Rental Management System 1.0 - Local File InclusionCVSS 9.8

Car Rental Management System 1.0 allows an unauthenticated user to perform a file inclusion attack against the /index.php file with a partial filename in the "page" parameter, leading to code execution.

Impact

An attacker can exploit this vulnerability to read sensitive files on the server, potentially leading to unauthorized access or information disclosure.

Remediation

Apply the latest patch or update provided by the vendor to fix the LFI vulnerability in the Car Rental Management System 1.0.

Authorsdaffainfo
Template tagscvecve2020lficar_rental_management_system_projectsqlivkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:car_rental_management_system_project:car_rental_management_system:1.0:*:*:*:*:*:*:*
Shodan: http.html:"car rental management system"
FOFA: body="car rental management system"
https://loopspell.medium.com/cve-2020-29227-unauthenticated-local-file-inclusion-7d3bd2c5c6a5 https://nvd.nist.gov/vuln/detail/CVE-2020-29227 https://www.sourcecodester.com/php/14544/car-rental-management-system-using-phpmysqli-source-code.html https://github.com/ARPSyndicate/cvemon https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

3