CVE-2024-40476

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-40476
A Cross-Site Request Forgery (CSRF) vulnerability was found in SourceCodester Best House Rental Management System v1.0. This could lead to an attacker tricking the administrator into adding/modifying/deleting valid tenant data via a crafted HTML page, as demonstrated by a Delete Tenant action at the /rental/ajax.php?action=delete_tenant.

8.0 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/takekaramey/CVE_Writeup/blob/main/Sourcecodester/Best%20House%20Rental%20Management%20System%20v1.0/CSRF.pdf Third Party Advisory
https://www.sourcecodester.com/php/17375/best-courier-management-system-project-php.html Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:mayurik:best_house_rental_management:1.0:*:*:*:*:*:*:*
History

15 Aug 2024, 13:43

Type Values Removed Values Added
First Time Mayurik best House Rental Management
Mayurik
CVSS v2 : unknown
v3 : 8.8 		v2 : unknown
v3 : 8.0
References () https://github.com/takekaramey/CVE_Writeup/blob/main/Sourcecodester/Best%20House%20Rental%20Management%20System%20v1.0/CSRF.pdf - () https://github.com/takekaramey/CVE_Writeup/blob/main/Sourcecodester/Best%20House%20Rental%20Management%20System%20v1.0/CSRF.pdf - Third Party Advisory
References () https://www.sourcecodester.com/php/17375/best-courier-management-system-project-php.html - () https://www.sourcecodester.com/php/17375/best-courier-management-system-project-php.html - Product
Summary
  • (es) Se encontró una vulnerabilidad de Cross-Site Request Forgery (CSRF) en SourceCodester Best House Rental Management System v1.0. Esto podría llevar a que un atacante engañe al administrador para que agregue/modifique/elimine datos válidos del inquilino a través de una página HTML manipulada, como lo demuestra la acción Eliminar inquilino en /rental/ajax.php?action=delete_tenant.
CPE cpe:2.3:a:mayurik:best_house_rental_management:1.0:*:*:*:*:*:*:*

13 Aug 2024, 01:13

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
CWE CWE-352

12 Aug 2024, 13:41

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-12 13:38

Updated : 2024-08-15 13:43

NVD link : CVE-2024-40476

Mitre link : CVE-2024-40476

CVE.ORG link : CVE-2024-40476

JSON object : View

Products Affected

mayurik

  • best_house_rental_management
CWE
CWE-352

Cross-Site Request Forgery (CSRF)