CVE-2024-12981: CodeAstro Car Rental System bookingconfirm.php sql injection

Published Dec 27, 2024

Updated

A vulnerability was found in CodeAstro Car Rental System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /bookingconfirm.php. The manipulation of the argument driveridfromdropdown leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.

Affected Software

2 affected components

Codeastro Car Rental System

Codeastro Car Rental System=1.0

Event History

Dec 27, 2024

CVE Published

via MITRE·05:31 AM

Data Sourced

via MITRE·05:31 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-12981?

CVE-2024-12981 is classified as a critical severity vulnerability.

What is the impact of CVE-2024-12981?

CVE-2024-12981 allows for SQL injection through manipulation of the driver_id_from_dropdown argument in the bookingconfirm.php file.

How do I fix CVE-2024-12981?

To fix CVE-2024-12981, ensure input validation and parameterized queries for the affected functionality in the CodeAstro Car Rental System.

Which version of CodeAstro Car Rental System is affected by CVE-2024-12981?

CVE-2024-12981 affects CodeAstro Car Rental System version 1.0.

Who is the vendor for the software affected by CVE-2024-12981?

The vendor for the software affected by CVE-2024-12981 is CodeAstro.