Critical severity · published Nov 2, 2023
CVE-2023-45019
Online Bus Booking System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'category' parameter of the category.php resource does not validate the characters received and they are sent unfiltered to the database.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OB
Online Bus Booking System · Projectworlds Pvt. Limited
1.0 · source: vendor, NVD, CISA
Affected product
OB
Online Bus Booking System
Projectworlds Pvt. Limited
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-45019
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-45019
Exploit
https://fluidattacks.com/advisories/oconnor
Product
https://projectworlds.in/
More from Online Bus Booking System
9.8
CVE-2023-45018
Online Bus Booking System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)
9.8
CVE-2023-45015
Online Bus Booking System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)
9.8
CVE-2023-45012
Online Bus Booking System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)