Lucene search
PRIOn knowledge basePRION:CVE-2023-39424HistorySep 07, 2023 - 1:15 p.m.
Hardcoded credentials
2023-09-0713:15:00
PRIOn knowledge base
www.prio-n.com
8
hardcoded credentials
remote attack
sql database
system privileges
authentication bypass
A vulnerability in RDPngFileUpload.dll, as used in the IRM Next Generation booking system, allows a remote attacker to upload arbitrary content (such as a web shell component) to the SQL database and execute it with SYSTEM privileges. This vulnerability requires authentication to be exploited but can be paired with another vulnerability in the platform (CVE-2023-39420, which grants access to hardcoded credentials) to carry the attack without having assigned credentials.
| CPE | Name | Operator | Version |
|---|---|---|---|
| internet_reservation_module_next_generation | eq | 5.3.2.15 |
Related
cve
cve
CVE-2023-39424
2023-09-07 13:15:08
CVE-2023-39420
2023-09-07 13:15:08
cvelist
cvelist
nvd
nvd
CVE-2023-39424
2023-09-07 13:15:08
CVE-2023-39420
2023-09-07 13:15:08
prion
prion
Design/Logic Flaw
2023-09-07 13:15:00