Online Lot Reservation System
Monthly
Unrestricted file upload in code-projects Online Lot Reservation System 1.0 allows an authenticated high-privilege user to upload arbitrary file types via the `image` parameter in /edithousepic.php, potentially enabling server-side code execution if the upload directory permits PHP execution. A publicly available proof-of-concept exploit exists on GitHub, though no active exploitation has been confirmed via CISA KEV. The mandatory high-privilege authentication barrier (PR:H per CVSS 4.0) substantially constrains the real-world attack surface despite the network-accessible vector.
Unrestricted file upload in code-projects Online Lot Reservation System 1.0 exposes the `/activity.php` endpoint to arbitrary file upload via the `directory` argument, enabling authenticated attackers to plant PHP webshells on the server. The CVSS 4.0 vector assigns PR:H, meaning exploitation is gated behind high-privilege administrative credentials - substantially narrowing the attack surface despite remote reachability. A public proof-of-concept is available on GitHub, but no confirmed active exploitation (CISA KEV) has been identified, and an EPSS of 0.03% signals very low opportunistic exploitation probability.
Path traversal in code-projects Online Lot Reservation System 1.0 allows unauthenticated remote attackers to read arbitrary files from the server by supplying directory traversal sequences in the unsanitized `File` parameter of `/download.php`. A public proof-of-concept exploit is available on GitHub, and SSVC classifies the attack as automatable with partial technical impact, though EPSS at 0.04% (13th percentile) indicates negligible observed exploitation activity to date. No CISA KEV listing exists, suggesting exploitation remains opportunistic rather than widespread.
SQL injection in code-projects Online Lot Reservation System 1.0 exposes the pre-authentication login endpoint `/loginuser.php` to unauthenticated remote database manipulation via the `email` and `password` parameters. A public POC has been disclosed on GitHub, though real-world exploitation risk is tempered by an EPSS of 0.03% (9th percentile), SSVC 'Exploitation: none', and the product's obscure deployment footprint. Successful exploitation yields partial compromise of confidentiality, integrity, and availability of the underlying database - consistent with CVSS 4.0 impact ratings of VC:L/VI:L/VA:L.
Unrestricted file upload in code-projects Online Lot Reservation System 1.0 allows an authenticated high-privilege user to upload arbitrary file types via the `image` parameter in /edithousepic.php, potentially enabling server-side code execution if the upload directory permits PHP execution. A publicly available proof-of-concept exploit exists on GitHub, though no active exploitation has been confirmed via CISA KEV. The mandatory high-privilege authentication barrier (PR:H per CVSS 4.0) substantially constrains the real-world attack surface despite the network-accessible vector.
Unrestricted file upload in code-projects Online Lot Reservation System 1.0 exposes the `/activity.php` endpoint to arbitrary file upload via the `directory` argument, enabling authenticated attackers to plant PHP webshells on the server. The CVSS 4.0 vector assigns PR:H, meaning exploitation is gated behind high-privilege administrative credentials - substantially narrowing the attack surface despite remote reachability. A public proof-of-concept is available on GitHub, but no confirmed active exploitation (CISA KEV) has been identified, and an EPSS of 0.03% signals very low opportunistic exploitation probability.
Path traversal in code-projects Online Lot Reservation System 1.0 allows unauthenticated remote attackers to read arbitrary files from the server by supplying directory traversal sequences in the unsanitized `File` parameter of `/download.php`. A public proof-of-concept exploit is available on GitHub, and SSVC classifies the attack as automatable with partial technical impact, though EPSS at 0.04% (13th percentile) indicates negligible observed exploitation activity to date. No CISA KEV listing exists, suggesting exploitation remains opportunistic rather than widespread.
SQL injection in code-projects Online Lot Reservation System 1.0 exposes the pre-authentication login endpoint `/loginuser.php` to unauthenticated remote database manipulation via the `email` and `password` parameters. A public POC has been disclosed on GitHub, though real-world exploitation risk is tempered by an EPSS of 0.03% (9th percentile), SSVC 'Exploitation: none', and the product's obscure deployment footprint. Successful exploitation yields partial compromise of confidentiality, integrity, and availability of the underlying database - consistent with CVSS 4.0 impact ratings of VC:L/VI:L/VA:L.