CVE-2023-50862

CRITICAL

kashipara travel_website v1.0 - Unauthenticated SQL Injection via booking.php hotelIDHidden Parameter

Title source: llm

Description

Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'hotelIDHidden' parameter of the booking.php resource does not validate the characters received and they are sent unfiltered to the database.

References (2)

Core 2

Core References

Product product

https://www.kashipara.com/

Exploit, Third Party Advisory third-party-advisory

https://fluidattacks.com/advisories/evans/

Scores

CVSS v3 9.8

EPSS 0.0067

EPSS Percentile 47.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-89

Status published

Products (1)

kashipara/travel_website 1.0

Published Jan 04, 2024

Tracked Since Feb 18, 2026