CVE-2017-17905

PHP Scripts Mall Car Rental Script has CSRF via admin/sitesettings.php...

CVE-2017-17905

Vulnerability: CVE-2017-17905 in PHP Scripts Mall Car Rental Script exhibits a Cross-Site Request Forgery (CSRF) through admin/sitesettings.php. Root cause: CSRF flaw allowing unauthorized state-changing requests via the affected admin interface. Impact (as stated): partial to high confidentialit...

CVE-2017-17906

PHP Scripts Mall Car Rental Script suffers an SQL Injection vulnerability in the admin/carlistedit.php carid parameter. The issue allows backend database manipulation, with high impact on confidentiality, integrity, and availability (CVSS v3.0 9.8). No remediation details are provided in the supp...

synergycarcentre.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-455722 Description| Value ---|--- Affected Website:| synergycarcentre.co.uk Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention...

PHP Scripts Mall Car Rental Script SQL Injection Vulnerability

PHP Scripts Mall Car Rental Script is a PHP based car rental website script by PHP Scripts Mall India. The script supports car rental reservation, vehicle type selection and user registration. A SQL injection vulnerability exists in PHP Scripts Mall Car Rental Script version 2.0.4. A remote...

CVE-2017-17637

Car Rental Script 2.0.4 has SQL Injection via the countrycode1.php val parameter...

CVE-2017-17637

Car Rental Script 2.0.4 has SQL Injection via the countrycode1.php val parameter...

Sql injection

Car Rental Script 2.0.4 has SQL Injection via the countrycode1.php val parameter...

CVE-2017-17637

Car Rental Script 2.0.4 has SQL Injection via the countrycode1.php val parameter...

CVE-2017-17637

CVE-2017-17637 affects Car Rental Script 2.0.4 with an SQL Injection in the countrycode1.php file via the val parameter. Multiple sources (NVD, CNVD, CVE lists, related CNVD and PRION records) corroborate a vulnerability in this script where user-supplied input is used in SQL without proper sanit...

CVE-2017-16691

SAP Note Assistant tool SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31,7.40, from 7.50 to 7.52 supports upload of digitally signed note file of type 'SAR'. The digital signature verification is done together with the extraction of note file contained in the SAR archive. It is possible...

Car Rental Script 2.0.4 SQL Injection

Exploit Title: Car Rental Script 2.0.4 - SQL Injection Dork: N/A Date: 10.12.2017 Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/car-rental-script/ Version: 2.0.4 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: N/A Exploit Author: Ihs...

universal-car-credit.com XSS vulnerability

Open Bug Bounty ID: OBB-449390 Description| Value ---|--- Affected Website:| universal-car-credit.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Preventio...

landfordcarcentre.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-448178 Description| Value ---|--- Affected Website:| landfordcarcentre.co.uk Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention...

porscheofstratham.com XSS vulnerability

Open Bug Bounty ID: OBB-436233 Description| Value ---|--- Affected Website:| porscheofstratham.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Daphne Caruana Galizia's Murder and the Security of WhatsApp

Daphne Caruana Galizia was a Maltese journalist whose anti-corruption investigations exposed powerful people. She was murdered in October by a car bomb. Galizia used WhatsApp to communicate securely with her sources. Now that she is dead, the Maltese police want to break into her phone or the app...

pick-a-car.co.uk XSS vulnerability

Vulnerable URL: http://www.pick-a-car.co.uk/searchpage.php?make==any+model=%27%22%3e%3csvg/onload=confirm/openbugbounty/%3e Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website...

riversidecarsales.co.uk XSS vulnerability

Vulnerable URL: http://www.riversidecarsales.co.uk/searchpage.php?make==any+model=%27%22%3e%3csvg/onload=confirm/openbugbounty/%3e Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 5571638 VIP website status:| No...

Cloud Energy App has SMS Bombing Vulnerability

Cloud Energy App is a software about car rental service. There is an SMS bombing vulnerability in Cloud Energy App. An attacker can exploit the vulnerability to replay packets sending verification codes without restriction and bombard the client with SMS...

littlecarcompany.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-390983 Description| Value ---|--- Affected Website:| littlecarcompany.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...