Hh-176

**Name of the Vulnerable Software and Affected Versions** itsourcecode Baptism Information Management System version 1.0 **Description** A remote SQL injection is possible due to improper handling of the `ID` argument within an unknown function in the '/delbaptism.php' endpoint. SQL injection is a technique where an attacker inserts malicious SQL code into a query, allowing them to manipulate the database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/delbaptism.php' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Baptism Information Management System version 1.0 **Description** A remote SQL injection exists in the `/editBaptism.php` endpoint. The issue occurs when the `ID` argument is manipulated, allowing an attacker to execute arbitrary SQL commands on the database. **Recommendations** As a temporary workaround, restrict access to the `/editBaptism.php` endpoint or avoid using the `ID` parameter until a fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Online Hotel Management System version 1.0 **Description** A SQL injection issue exists in the `/admin/mod amenities/controller.php?action=edit` endpoint. This occurs when the `amen id` variable is manipulated, allowing a remote attacker to execute arbitrary SQL commands. **Recommendations** As a temporary workaround, restrict access to the `/admin/mod amenities/controller.php?action=edit` endpoint or avoid using the `amen id` parameter until a fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Online Hotel Management System version 1.0 **Description** A flaw in the `/admin/mod amenities/controller.php?action=add` endpoint allows for unrestricted file upload. By manipulating the `image` argument, a remote attacker can upload arbitrary files to the server. **Recommendations** Restrict access to the `/admin/mod amenities/controller.php?action=add` endpoint or disable upload functionality immediately. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Online Hotel Management System version 1.0 **Description** A remote cross site scripting issue exists in the POST Request Handler component. The flaw occurs when the `Name` argument is manipulated within the '/admin/mod amenities/controller.php?action=add' endpoint. Cross site scripting is a technique where malicious scripts are injected into trusted websites. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `Name` parameter in the '/admin/mod amenities/controller.php?action=add' endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Online Hotel Management System version 1.0 **Description** A remote SQL injection exists in the functionality of the '/admin/mod users/controller.php?action=add' endpoint. The issue occurs when the `Name` argument is manipulated, allowing an attacker to execute arbitrary SQL commands on the database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `Name` parameter in the '/admin/mod users/controller.php?action=add' endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Online Hotel Management System version 1.0 **Description** A remote cross site scripting issue exists in the POST Request Handler component. The flaw occurs when the `Name` argument is manipulated within the '/admin/mod users/controller.php?action=edit' endpoint. Cross site scripting is a technique where malicious scripts are injected into trusted websites. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Online Hotel Management System version 1.0 **Description** A cross site scripting issue exists in the POST Request Handler component. A remote attacker can exploit this by manipulating the `Name` argument within the '/admin/mod room/controller.php?action=add' endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.