CVE-2024-9298
SourceCodester Online Railway Reservation System Ticket ?page=tickets access control
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 28, 2024
- Updated
- Sep 30, 2024
- Reserved
- Sep 27, 2024
Description
A vulnerability was found in SourceCodester Online Railway Reservation System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /?page=tickets of the component Ticket Handler. The manipulation of the argument id leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | VulDB |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | VulDB |
| 3.0 | 4.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | VulDB |
| 2.0 | 4.0 Medium | AV:N/AC:L/Au:S/C:P/I:N/A:N | VulDB |
Weaknesses
- CWE-284 Improper Access Controls
Affected Products
| Product | Versions |
|---|---|
Online Railway Reservation SystemSourceCodester |
|
References
- VDB-278792 | SourceCodester Online Railway Reservation System Ticket ?page=tickets access controlvdb-entrytechnical-description
- VDB-278792 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #412740 | SourceCodester Online Railway Reservation System 1.0 Broken Access Controlthird-party-advisory
- https://github.com/gurudattch/CVEs/blob/main/Sourcecoderster-Online-Railway-Reservation-System-IDOR.mdexploit
- https://www.sourcecodester.com/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.