A vulnerability classified as critical has been found in SourceCodester Best House Rental Management System 1.0. This affects an unknown part of the file /rental/ajax.php?action=delete_tenant of the component POST Request Handler. The manipulation of the argument id leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
History

Wed, 04 Dec 2024 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Mayurik
Mayurik best House Rental Management System
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:a:mayurik:best_house_rental_management_system:1.0:*:*:*:*:*:*:*
Vendors & Products Mayurik
Mayurik best House Rental Management System

Wed, 27 Nov 2024 21:15:00 +0000

Type Values Removed Values Added
First Time appeared Sourcecodester
Sourcecodester best House Rental Management System
CPEs cpe:2.3:a:sourcecodester:best_house_rental_management_system:1.0:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester best House Rental Management System
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Wed, 27 Nov 2024 16:45:00 +0000

Type Values Removed Values Added
Description A vulnerability classified as critical has been found in SourceCodester Best House Rental Management System 1.0. This affects an unknown part of the file /rental/ajax.php?action=delete_tenant of the component POST Request Handler. The manipulation of the argument id leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Title SourceCodester Best House Rental Management System POST Request ajax.php improper authorization
Weaknesses CWE-266
CWE-285
References
Metrics cvssV2_0

{'score': 6.4, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:P'}

cvssV3_0

{'score': 6.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'}

cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N'}


cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2024-11-27T16:31:05.325Z

Updated: 2024-11-28T06:47:46.222Z

Reserved: 2024-11-27T11:18:46.895Z

Link: CVE-2024-11860

cve-icon Vulnrichment

Updated: 2024-11-27T20:33:04.368Z

cve-icon NVD

Status : Analyzed

Published: 2024-11-27T17:15:10.010

Modified: 2024-12-04T21:08:39.133

Link: CVE-2024-11860

cve-icon Redhat

No data.