vendor:
Online Booking System - NodAPS
by:
Borna nematzadeh (L0RD)
8.8
CVSS
HIGH
SQL Injection/Cross-Site Request Forgery
352
CWE
Product Name: Online Booking System - NodAPS
Affected Version From: 4.0
Affected Version To: 4.0
Patch Exists: NO
Related CWE: N/A
CPE: a:codecanyon:online_booking_system_-_nodaps
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: Windows
2018
Online Booking system – NodAPS 4.0 – ‘search’ SQL injection / Cross-Site Request Forgery
An issue was discovered in Online Booking system - NodAPS 4.0 script. With Cross-site request forgery (CSRF) vulnerability, attacker can hijack the authentication of users remotely. Put ' in the search parameter and you will have SQL syntax error. You can use 'extractvalue()' or 'updatexml()' functions to get data from database.
Mitigation:
Implement CSRF protection mechanisms such as synchronizer tokens, origin checks, and referrer checks.
