Dig-Bick

**Name of the Vulnerable Software and Affected Versions** Online Tours & Travels Management System version 1.0 **Description** The issue is related to an arbitrary file upload vulnerability in the `update profile.php` component. This allows attackers to execute arbitrary code via a crafted PHP file. **Recommendations** For Online Tours & Travels Management System version 1.0, consider disabling the `update profile.php` component until a patch is available to prevent arbitrary file uploads. Restrict access to this component to minimize the risk of exploitation. Avoid using this component to upload files until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Online Diagnostic Lab Management System version 1.0 **Description** The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the `id` parameter at the "/odlms/classes/Users.php?f=delete test" API endpoint. **Recommendations** For Online Diagnostic Lab Management System version 1.0, as a temporary workaround, consider restricting access to the "/odlms/classes/Users.php?f=delete test" API endpoint to minimize the risk of exploitation. Avoid using the `id` parameter in this endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Online Diagnostic Lab Management System version 1.0 **Description** The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the `id` parameter at the "/odlms/classes/Users.php?f=delete" API endpoint. **Recommendations** For Online Diagnostic Lab Management System version 1.0, avoid using the `id` parameter in the "/odlms/classes/Users.php?f=delete" API endpoint until the issue is resolved. As a temporary workaround, consider restricting access to the Users.php file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.