{"id":"CVE-2024-3349","state":"PUBLISHED","title":"SourceCodester Aplaya Beach Resort Online Reservation System login.php sql injection","description":"A vulnerability classified as critical was found in SourceCodester Aplaya Beach Resort Online Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/login.php. The manipulation of the argument email leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259453 was assigned to this vulnerability.","publishedAt":"2024-04-05T17:00:05.525Z","updatedAt":"2024-08-19T19:00:26.547Z","severity":{"score":7.3,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","source":"VulDB"},"assigner":"VulDB","products":["SourceCodester Aplaya Beach Resort Online Reservation System"],"affected":[{"vendor":"SourceCodester","product":"Aplaya Beach Resort Online Reservation System","versions":[{"version":"1.0","status":"affected"}]}],"references":["https://vuldb.com/?id.259453","https://vuldb.com/?ctiid.259453","https://vuldb.com/?submit.310217","https://github.com/qqqyc/vlun1/blob/main/Aplaya-Beach-Resort-Online-Reservation-System-02"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-29T20:07:39.287Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/3xxx/CVE-2024-3349.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-3349","state":"PUBLISHED","datePublished":"2024-04-05T17:00:05.525Z","dateUpdated":"2024-08-19T19:00:26.547Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2024-04-05T05:51:46.226Z"},"containers":{"cna":{"title":"SourceCodester Aplaya Beach Resort Online Reservation System login.php sql injection","descriptions":[{"lang":"en","value":"A vulnerability classified as critical was found in SourceCodester Aplaya Beach Resort Online Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/login.php. The manipulation of the argument email leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259453 was assigned to this vulnerability."},{"lang":"de","value":"In SourceCodester Aplaya Beach Resort Online Reservation System 1.0 wurde eine kritische Schwachstelle entdeckt. Dabei geht es um eine nicht genauer bekannte Funktion der Datei admin/login.php. Durch das Manipulieren des Arguments email mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung."}],"affected":[{"vendor":"SourceCodester","product":"Aplaya Beach Resort Online Reservation System","versions":[{"version":"1.0","status":"affected"}]}],"references":[{"url":"https://vuldb.com/?id.259453","name":"VDB-259453 | SourceCodester Aplaya Beach Resort Online Reservation System login.php sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.259453","name":"VDB-259453 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.310217","name":"Submit #310217 | https://www.sourcecodester.com/ Aplaya Beach Resort Online Reservation System 1.0 SQL Injection","tags":["third-party-advisory"]},{"url":"https://github.com/qqqyc/vlun1/blob/main/Aplaya-Beach-Resort-Online-Reservation-System-02","tags":["exploit"]}],"metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"HIGH"}},{"cvssV3_0":{"version":"3.0","baseScore":7.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"HIGH"}},{"cvssV2_0":{"version":"2.0","baseScore":7.5,"vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","type":"CWE","lang":"en","description":"CWE-89 SQL Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2024-04-05T17:00:05.525Z"},"timeline":[{"time":"2024-04-05T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2024-04-05T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2024-04-05T07:56:58.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"qianzui1004 (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"sourcecodester","product":"aplaya_beach_resort_online_reservation_system","defaultStatus":"unknown","versions":[{"version":"1.0","status":"affected"}],"cpes":["cpe:2.3:a:sourcecodester:aplaya_beach_resort_online_reservation_system:1.0:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-08-19T18:59:48.395168Z","id":"CVE-2024-3349","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-08-19T19:00:26.547Z"}},{"title":"CVE Program Container","references":[{"url":"https://vuldb.com/?id.259453","name":"VDB-259453 | SourceCodester Aplaya Beach Resort Online Reservation System login.php sql injection","tags":["vdb-entry","technical-description","x_transferred"]},{"url":"https://vuldb.com/?ctiid.259453","name":"VDB-259453 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required","x_transferred"]},{"url":"https://vuldb.com/?submit.310217","name":"Submit #310217 | https://www.sourcecodester.com/ Aplaya Beach Resort Online Reservation System 1.0 SQL Injection","tags":["third-party-advisory","x_transferred"]},{"url":"https://github.com/qqqyc/vlun1/blob/main/Aplaya-Beach-Resort-Online-Reservation-System-02","tags":["exploit","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T20:05:08.510Z"}}]}}}