CVE-2024-6116: itsourcecode Simple Online Hotel Reservation System edit_room.php unrestricted upload
A vulnerability, which was classified as critical, has been found in itsourcecode Simple Online Hotel Reservation System 1.0. Affected by this issue is some unknown functionality of the file editroom.php. The manipulation of the argument photo leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-268868.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate the VDB-268868 issue affecting edit_room.php by preventing unrestricted file uploads via the manipulated photo argument (e.g., enforce server-side upload validation/allowlist of file types and limit upload handling for the photo upload functionality).
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6116?
CVE-2024-6116 is classified as a critical vulnerability.
What is the impact of CVE-2024-6116?
CVE-2024-6116 allows for unrestricted file upload through the edit_room.php functionality.
How do I fix CVE-2024-6116?
To fix CVE-2024-6116, you should implement restrictions on the file upload functionality in the affected system.
Which version of the Simple Online Hotel Reservation System is affected by CVE-2024-6116?
CVE-2024-6116 affects version 1.0 of the Simple Online Hotel Reservation System.
What file is associated with CVE-2024-6116?
The file associated with CVE-2024-6116 is edit_room.php.