Description
A vulnerability was determined in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file /tourism/classes/Login.php?f=login of the component Login. This manipulation of the argument Username causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
References (6)
Core 6
Core References
Various Sources product
https://www.sourcecodester.com/
Permissions Required, VDB Entry vdb-entry
technical-description
https://vuldb.com/?id.349724
Permissions Required, VDB Entry signature
permissions-required
https://vuldb.com/?ctiid.349724
Permissions Required, VDB Entry third-party-advisory
https://vuldb.com/?submit.767882
Third Party Advisory exploit
https://github.com/CH0ico/CVE_choco_7/blob/main/report.md
Scores
CVSS v3
7.3
EPSS
0.0007
EPSS Percentile
21.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-74
CWE-89
Status
published
Products (1)
oretnom23/simple_responsive_tourism_website
1.0
Published
Mar 08, 2026
Tracked Since
Mar 08, 2026