vendor:
Shuttle-Booking-Software
by:
nu11secur1ty
8.1
CVSS
CRITICAL
SQL Injection
CWE
Product Name: Shuttle-Booking-Software
Affected Version From: 1
Affected Version To: 1
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested: None
2023
Shuttle-Booking-Software v1.0 – Multiple-SQLi
The location_id parameter in Shuttle-Booking-Software v1.0 is vulnerable to SQL injection attacks. By submitting a single quote or two single quotes in the location_id parameter, an attacker can trigger a database error message or retrieve information from the database.
Mitigation:
To mitigate this vulnerability, the vendor should sanitize user input before using it in SQL queries or use parameterized queries to prevent SQL injection attacks.
