CVE-2023-39423 Improper Neutralization of Special Elements used in an SQL Command in RDPData.dll

The RDPData.dll file exposes the /irmdata/api/common endpoint that handles session IDs, among other features. By using a UNION SQL operator, an attacker can leak the sessions table, obtain the currently valid sessions and impersonate a currently logged-in user...

CVE-2023-39423 Improper Neutralization of Special Elements used in an SQL Command in RDPData.dll

The RDPData.dll file exposes the /irmdata/api/common endpoint that handles session IDs, among other features. By using a UNION SQL operator, an attacker can leak the sessions table, obtain the currently valid sessions and impersonate a currently logged-in user...

CVE-2023-39422 Use of Hard-coded Credentials in multiple /irmdata/api/ endpoints

The /irmdata/api/ endpoints exposed by the IRM Next Generation booking engine authenticates requests using HMAC tokens. These tokens are however exposed in a JavaScript file loaded on the client side, thus rendering this extra safety mechanism useless...

CVE-2023-39422: Use of Hard-coded Credentials

The /irmdata/api/ endpoints exposed by the IRM Next Generation booking engine authenticates requests using HMAC tokens. These tokens are however exposed in a JavaScript file loaded on the client side, thus rendering this extra safety mechanism useless...

PT-2023-26944 · Resort Data Processing +1 · Irm Next Generation +1

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: The RDPData.dll file exposes the "/irmdata/api/common" endpoint that handles session IDs, among other features. By using a UNION SQL operator, an attacker can leak the sessions table, obta...