hotel_management_system_project - MidnightBSD Security Advisories

CVE-2021-41651 MEDIUM

A blind SQL injection vulnerability exists in the Raymart DG / Ahmed Helal Hotel-mgmt-system. A malicious attacker can retrieve sensitive database information and interact with the database using the vulnerable cid parameter in process_update_profile.php.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
hotel_management_system_project	hotel_management_system	-

CVE-2022-2291 MEDIUM

A vulnerability was found in SourceCodester Hotel Management System 2.0. It has been rated as problematic. This issue affects some unknown processing of the file /ci_hms/search of the component Search. The manipulation of the argument search with the input "><script>alert("XSS")</script> leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N	2.8	2.5
cna@vuldb.com	4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	2.8	1.4

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-79,CWE-79,

Products Affected

Vendor	Product	Version
hotel_management_system_project	hotel_management_system	2.0

CVE-2022-2292 LOW

A vulnerability classified as problematic has been found in SourceCodester Hotel Management System 2.0. Affected is an unknown function of the file /ci_hms/massage_room/edit/1 of the component Room Edit Page. The manipulation of the argument massageroomDetails with the input "><script>alert("XSS")</script> leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7
cna@vuldb.com	3.5	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N	2.1	1.4

CVSS 2.0

Severity: LOW

Problem Type: CWE-79,CWE-79,

Products Affected

Vendor	Product	Version
hotel_management_system_project	hotel_management_system	2.0

CVE-2022-27475 MEDIUM

Cross site scripting (XSS) vulnerability in tramyardg hotel-mgmt-system, allows attackers to execute arbitrary code when when /admin.php is loaded.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-79,

Products Affected

Vendor	Product	Version
hotel_management_system_project	hotel_management_system	1.0

CVE-2022-28110 HIGH

Hotel Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at the login page.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9

CVSS 2.0

Severity: HIGH

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
hotel_management_system_project	hotel_management_system	1.0

CVE-2022-36254

Multiple persistent cross-site scripting (XSS) vulnerabilities in index.php in tramyardg Hotel Management System 1.0 allow remote attackers to inject arbitrary web script or HTML via multiple parameters such as "fullname".

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7

Products Affected

Vendor	Product	Version
hotel_management_system_project	hotel_management_system	1.0

CVE-2022-48090

Tramyardg hotel-mgmt-system version 2022.4 is vulnerable to SQL Injection via /app/dao/CustomerDAO.php.

Products Affected

Vendor	Product	Version
hotel_management_system_project	hotel_management_system	2022-04-11

CVE-2022-48091

Tramyardg hotel-mgmt-system version 2022.4 is vulnerable to Cross Site Scripting (XSS) via process_update_profile.php.

Products Affected

Vendor	Product	Version
hotel_management_system_project	hotel_management_system	2022-04-11

CVE-2024-25314

Code-projects Hotel Managment System 1.0, allows SQL Injection via the 'sid' parameter in Hotel/admin/show.php?sid=2.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9

Products Affected

Vendor	Product	Version
hotel_management_system_project	hotel_management_system	1.0

CVE-2024-25315

Code-projects Hotel Managment System 1.0, allows SQL Injection via the 'rid' parameter in Hotel/admin/roombook.php?rid=2.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9

Products Affected

Vendor	Product	Version
hotel_management_system_project	hotel_management_system	1.0

CVE-2024-25316

Code-projects Hotel Managment System 1.0 allows SQL Injection via the 'eid' parameter in Hotel/admin/usersettingdel.php?eid=2.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9

Products Affected

Vendor	Product	Version
hotel_management_system_project	hotel_management_system	1.0

CVE-2024-25318

Code-projects Hotel Managment System 1.0 allows SQL Injection via the 'pid' parameter in Hotel/admin/print.php?pid=2.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	2.8	5.9

Products Affected

Vendor	Product	Version
hotel_management_system_project	hotel_management_system	1.0

Advisories for hotel_management_system_project