CVE-2022-3774

🗓️ 31 Oct 2022 00:00:00Reported by VulDBType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 42 Views🌐 WEB

Vulnerability in SourceCodester Train Scheduler App 1.0 allows remote attackers to improperly control resource identifiers via manipulation of the id argument in /train_scheduler_app/?action=delete (CVE-2022-3774)

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2022-3774	31 Oct 202219:37	–	circl
CNNVD	Train Scheduler App 安全漏洞	31 Oct 202200:00	–	cnnvd
Cvelist	CVE-2022-3774 SourceCodester Train Scheduler App resource injection	31 Oct 202200:00	–	cvelist
EUVD	EUVD-2022-43124	3 Oct 202520:07	–	euvd
NVD	CVE-2022-3774	31 Oct 202216:15	–	nvd
Packet Storm	Train Scheduler App 1.0 Insecure Direct Object Reference	31 Oct 202200:00	–	packetstorm
Prion	Design/Logic Flaw	31 Oct 202216:15	–	prion
Positive Technologies	PT-2022-24055 · Unknown · Sourcecodester Train Scheduler App	31 Oct 202200:00	–	ptsecurity
RedhatCVE	CVE-2022-3774	22 May 202523:16	–	redhatcve
Vulnrichment	CVE-2022-3774 SourceCodester Train Scheduler App resource injection	31 Oct 202200:00	–	vulnrichment

NVD

Vulners

Node

train_scheduler_app_project train_scheduler_appMatch1.0

[
  {
    "vendor": "SourceCodester",
    "product": "Train Scheduler App",
    "versions": [
      {
        "version": "1.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/rohit0x5/poc/blob/main/idor
packetstormsecurity	www.packetstormsecurity.com/files/169604/Train-Scheduler-App-1.0-Insecure-Direct-Object-Reference.html
vuldb	www.vuldb.com/

Parameter	Position	Path	Description	CWE
action	query param	/train_scheduler_app/?action=delete&id=5	Insecure Direct Object Reference (IDOR) via delete action to manipulate resource by changing id	CWE-99
id	query param	/train_scheduler_app/?action=delete&id=5	Insecure Direct Object Reference (IDOR) via delete action to manipulate resource by changing id	CWE-99