CVE-2019-6497

HotelsServer through 2018-11-05 has SQL Injection via the controller/fetchpwd.php username parameter...

Default credentials

controller/fetchpwd.php and controller/doAction.php in HotelsServer through 2018-11-05 rely on base64 in an attempt to protect password storage...

CVE-2019-7648: Inadequate Encryption Strength

controller/fetchpwd.php and controller/doAction.php in HotelsServer through 2018-11-05 rely on base64 in an attempt to protect password storage...

Sql injection

HotelsServer through 2018-11-05 has SQL Injection via the controller/fetchpwd.php username parameter...

CVE-2019-6497

HotelsServer through 2018-11-05 has SQL Injection via the controller/fetchpwd.php username parameter...

CVE-2019-6497

HotelsServer through 2018-11-05 has SQL Injection via the controller/fetchpwd.php username parameter...

CVE-2019-6497

Technical details about CVE-2019-6497 are not publicly provided in the supplied documents. Monitor for updates from vendors and CERT/NSCs for affected products, versions, and fix information.

PT-2019-18119

Name of the Vulnerable Software and Affected Versions Hotels Server versions prior to 2018-11-05 Description The issue allows for SQL Injection via the username parameter in the "controller/fetchpwd.php" API endpoint. Recommendations For versions prior to 2018-11-05, update to a version released...

CVE-2019-6497: Improper Neutralization of Special Elements used in an SQL Command

HotelsServer through 2018-11-05 has SQL Injection via the controller/fetchpwd.php username parameter...