CVE-2020-25889

Опубликовано: 08 дек. 2020

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

Online Bus Booking System Project Using PHP/MySQL version 1.0 has SQL injection via the login page. By placing SQL injection payload on the login page attackers can bypass the authentication and can gain the admin privilege.

Ссылки

http://packetstormsecurity.com/files/160397/Online-Bus-Booking-System-Project-Using-PHP-MySQL-1.0-SQL-Injection.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2020/Dec/4
Mailing List
Third Party Advisory
https://seclists.org/fulldisclosure/2020/Dec/4
Mailing List
Third Party Advisory
https://www.sourcecodester.com/php/14438/online-bus-booking-system-project-using-phpmysql.html
Third Party Advisory
http://packetstormsecurity.com/files/160397/Online-Bus-Booking-System-Project-Using-PHP-MySQL-1.0-SQL-Injection.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2020/Dec/4
Mailing List
Third Party Advisory
https://seclists.org/fulldisclosure/2020/Dec/4
Mailing List
Third Party Advisory
https://www.sourcecodester.com/php/14438/online-bus-booking-system-project-using-phpmysql.html
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:online_bus_booking_system_project:online_bus_booking_system:1.0:*:*:*:*:*:*:*

EPSS

Процентиль: 80%

0.0138

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-qgr9-4rvm-qxmp

github

больше 3 лет назад