PT-2022-20139
CVE-2022-30490
·
تاريخ النشر
2022-06-01
·
تاريخ التحديث
2022-06-10
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Badminton Center Management System version 1.0
Description
The issue concerns SQL Injection via the
id parameter in the "/bcms/admin/court rentals/update status.php" API endpoint. This allows for potential manipulation of database queries.Recommendations
For Badminton Center Management System version 1.0, consider restricting access to the "/bcms/admin/court rentals/update status.php" API endpoint to minimize the risk of exploitation. Avoid using the
id parameter in this endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾