CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in CultBooking CultBooking Hotel Booking Engine cultbooking-booking-engine allows Stored XSS.This issue affects CultBooking Hotel Booking Engine: from n/a through <= 2.1.
Explanation of Vulnerability in Simple Terms
CultBooking Hotel Booking Engine versions 2.1 and earlier are vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the booking engine without their knowledge. The vulnerability requires user interaction and can affect confidentiality, integrity, and availability of the booking system.
What an attacker can do
Perform unauthorized actions on the booking engine by tricking an admin into visiting a malicious webpage.
Potential impact on your site
Attackers can modify bookings, settings, or user data if an admin visits a malicious link while logged into the booking engine.
Conditions required to exploit
Admin must be logged in and visit an attacker-controlled webpage; no special privileges required to craft the attack.
Key dates
External resources
Related vulnerabilities
