Tourism Management System
CVE-2022-30930
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Tourism Management System Version: V 3.2 is affected by: Cross Site Request Forgery (CSRF).
AnalysisAI
Tourism Management System Version: V 3.2 is affected by: Cross Site Request Forgery (CSRF). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
This vulnerability is classified as Cross-Site Request Forgery (CSRF) (CWE-352), which allows attackers to trick authenticated users into performing unintended actions. Tourism Management System Version: V 3.2 is affected by: Cross Site Request Forgery (CSRF). Affected products include: Phpgurukul Tourism Management System.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement anti-CSRF tokens, validate Origin/Referer headers, use SameSite cookie attribute.
More in Tourism Management System
View allPhpgurukul Tourism Management System v2.0 is vulnerable to Unrestricted Upload of File with Dangerous Type via tms/admin
An Arbitrary File Upload is discovered in SourceCodester Tourism Management System 1.0 allows the user to conduct remote
Phpgurukul Tourism Management System v2.0 is vulnerable to Unrestricted Upload of File with Dangerous Type via /tms/admi
A Shell Upload vulnerability in Tourism Management System 2.0 allows an attacker to upload and execute arbitrary PHP she
A reflected cross-site scripting (XSS) vulnerability in Phpgurukul Tourism Management System v2.0 allows attackers to ex
Unauthenticated remote attackers can register accounts with elevated (administrator) privileges in jaychouchannel Touris
SQL injection in jaychouchannel's Tourism-Management-System (Java Spring Boot, up to commit 8122bf02) allows unauthentic
A security flaw has been discovered in PHPGurukul Tourism Management System 1.0. Rated medium severity (CVSS 6.9), this
Missing authentication on update endpoints in jaychouchannel's Tourism-Management-System exposes write operations across
Authorization bypass in jaychouchannel's Tourism-Management-System allows authenticated remote users to access or modify
Authorization bypass in jaychouchannel's Tourism-Management-System (all Java/Spring Boot commits through 84d8ec384f) all
A vulnerability classified as problematic has been found in PHPGurukul Tourism Management System 1.0. Rated medium sever
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today