Fishing Reservation System 7.5 contains multiple remote SQL injection vulnerabilities in admin.php, cart.php, and calendar.php that allow attackers to inject malicious SQL commands. Attackers can exploit vulnerable parameters like uid, pid, type, m, y, and code to compromise the database management system and web application without user interaction.
Attack Parameters
Attack Vector
Network
Атака возможна удалённо
Attack Complexity
Low
Легко эксплуатировать
Attack Requirements
None
Нет дополнительных условий
Privileges Required
Low
Нужны базовые права
User Interaction
None
Не нужно действие пользователя
Impact Assessment
Confidentiality
High
Полная утечка данных
Integrity
Low
Частичная модификация данных
Availability
None
Нет нарушения работы
CVSS Vector v4.0
Weakness Type (CWE)
References 4
https://fishingreservationsystem.com/index.html
disclosure@vulncheck.com
https://www.exploit-db.com/exploits/48417
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/fishing-reservation-system-uid-sql-injecti…
disclosure@vulncheck.com
https://www.vulnerability-lab.com/get_content.php?id=2243
disclosure@vulncheck.com