CVE-2024-42765

A SQL injection vulnerability in "/login.php" of the Kashipara Bus Ticket Reservation System v1.0 allows remote attackers to execute arbitrary SQL commands and bypass Login via the "email" or "password" Login page parameters.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - cve@mitre.org

Published

2024-08-23

Last modified

2024-08-23

Weaknesses

CWE-89

Affected products

• Bus Ticket Reservation System (Kashipara)
• Bus Ticket Reservation System (Kjayvik)

References

• https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Bus%20Ticket%20Reservation%20System%20v1.0/SQL%20Injecti…
• https://www.kashipara.com/