CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Oganro PixelBeds Channel Manager and Hotel Booking Engine pixelbeds-channel-manager-booking-engine allows Cross Site Request Forgery.This issue affects PixelBeds Channel Manager and Hotel Booking Engine: from n/a through <= 1.0.
Explanation of Vulnerability in Simple Terms
PixelBeds Channel Manager and Hotel Booking Engine versions 1.0 and earlier are vulnerable to cross-site request forgery (CSRF). An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the booking system without the admin's knowledge or consent. The vulnerability requires user interaction but does not require authentication.
What an attacker can do
Perform unwanted actions on the booking system by tricking an admin into visiting a malicious webpage.
Potential impact on your site
Hotel booking settings, reservations, or configurations could be altered without admin authorization.
Conditions required to exploit
Admin must be logged in and visit an attacker-controlled webpage or link.
Key dates
External resources
Related vulnerabilities
