CVE-2024-57487

The Code-Projects Online Car Rental System 1.0 is vulnerable to Remote Code Execution (RCE) via its file upload feature. The root cause is a lack of validation for file extensions and MIME types , which allows an authenticated attacker to upload unrestricted PHP shells . Specifically, the changei...

CVE-2024-57488

The Code-Projects Online Car Rental System version 1.0 is vulnerable to Stored Cross-Site Scripting (XSS) . This vulnerability exists within the /admin/edit-vehicle.php page due to insufficient validation of the vehicalorcview parameter. An authenticated attacker can inject malicious JavaScript p...