vendor:
Tourism Website Blog
by:
Ihsan Sencan
7.5
CVSS
HIGH
Remote Code Execution / SQL Injection
89
CWE
Product Name: Tourism Website Blog
Affected Version From: 1.0
Affected Version To: 1.0
Patch Exists: NO
Related CWE: N/A
CPE: a:sourcecodester:tourism_website_blog:1.0
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: WiN7_x64/KaLiLinuX_x64
2018
Exploit Title: Tourism Website Blog – Remote Code Execution / SQL Injection
A vulnerability exists in Tourism Website Blog, which allows an attacker to execute arbitrary code or perform an SQL injection attack. The vulnerability is due to improper input validation in the 'add_city.php' and 'category.php' scripts. An attacker can exploit this vulnerability by sending a specially crafted HTTP request containing malicious code. This can allow the attacker to execute arbitrary code or perform an SQL injection attack.
Mitigation:
Input validation should be performed to ensure that user-supplied data is properly sanitized before being used in the application. Additionally, the application should be configured to use the latest version of the web server and database server software.