online_railway_reservation_system_project - MidnightBSD Security Advisories

CVE-2021-46308 HIGH

An SQL Injection vulnerability exists in Sourcecodester Online Railway Reservation Sysytem 1.0 via the sid parameter.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9

CVSS 2.0

Severity: HIGH

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
online_railway_reservation_system_project	online_railway_reservation_system	1.0

CVE-2022-33042 MEDIUM

Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/inquiries/view_details.php.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	7.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	1.2	5.9

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
online_railway_reservation_system_project	online_railway_reservation_system	1.0

CVE-2022-33048 MEDIUM

Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /orrs/admin/reservations/view_details.php.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	7.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	1.2	5.9

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
online_railway_reservation_system_project	online_railway_reservation_system	1.0

CVE-2022-33049 MEDIUM

Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /orrs/admin/?page=user/manage_user.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	7.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	1.2	5.9

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
online_railway_reservation_system_project	online_railway_reservation_system	1.0

CVE-2022-33055 MEDIUM

Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /orrs/admin/trains/manage_train.php.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	7.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	1.2	5.9

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
online_railway_reservation_system_project	online_railway_reservation_system	1.0

CVE-2022-33056 MEDIUM

Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /orrs/admin/schedules/manage_schedule.php.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	7.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	1.2	5.9

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
online_railway_reservation_system_project	online_railway_reservation_system	1.0

CVE-2022-33057 MEDIUM

Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_reservation.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	7.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	1.2	5.9

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
online_railway_reservation_system_project	online_railway_reservation_system	1.0

CVE-2022-33058 MEDIUM

Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_message.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	7.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	1.2	5.9

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
online_railway_reservation_system_project	online_railway_reservation_system	1.0

CVE-2022-33059 MEDIUM

Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_train.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	7.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	1.2	5.9

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
online_railway_reservation_system_project	online_railway_reservation_system	1.0

CVE-2022-33060 MEDIUM

Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_schedule.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	7.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	1.2	5.9

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
online_railway_reservation_system_project	online_railway_reservation_system	1.0

CVE-2022-33061 MEDIUM

Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_service.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	7.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	1.2	5.9

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
online_railway_reservation_system_project	online_railway_reservation_system	1.0

CVE-2024-0782 MEDIUM

A vulnerability has been found in CodeAstro Online Railway Reservation System 1.0 and classified as problematic. This vulnerability affects unknown code of the file pass-profile.php. The manipulation of the argument First Name/Last Name/User Name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-251698 is the identifier assigned to this vulnerability.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
cna@vuldb.com	3.5	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N	2.1	1.4
nvd@nist.gov	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-79,

Products Affected

Vendor	Product	Version
online_railway_reservation_system_project	online_railway_reservation_system	1.0

CVE-2024-7910 MEDIUM

A vulnerability was found in CodeAstro Online Railway Reservation System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/emp-profile-avatar.php of the component Profile Photo Update Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
cna@vuldb.com	4.7	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L	1.2	3.4
nvd@nist.gov	7.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	1.2	5.9

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-434,

Products Affected

Vendor	Product	Version
online_railway_reservation_system_project	online_railway_reservation_system	1.0

CVE-2024-7912 MEDIUM

A vulnerability was found in CodeAstro Online Railway Reservation System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/assets/. The manipulation leads to exposure of information through directory listing. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
cna@vuldb.com	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4
nvd@nist.gov	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4

CVSS 2.0

Severity: MEDIUM

Problem Type: NVD-CWE-Other,CWE-548,

Products Affected

Vendor	Product	Version
online_railway_reservation_system_project	online_railway_reservation_system	1.0

Advisories for online_railway_reservation_system_project