CVE-2019-25482: Jettweb Hazir Rent A Car Sitesi Scripti, инжекция

Описание

Оригинално описание

Jettweb PHP Hazir Rent A Car Sitesi Scripti V2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the arac_kategori_id parameter. Attackers can send POST requests to the endpoint with malicious SQL payloads to extract sensitive database information.

Засегнати продукти

• Jettweb Hazir Rent A Car Sitesi Scripti: 2.0

Вид слабост

• CWE-89 SQL инжекция

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2019-25482
• https://nvd.nist.gov/vuln/detail/CVE-2019-25482
• https://www.exploit-db.com/exploits/46624
• https://www.vulncheck.com/advisories/jettweb-php-hazir-rent-a-car-sitesi-scripti-v2-sql-injection