SQL Injection in Tourismscripts Tourism Script Accomodation Hotel Booking Portal
CVE-2009-4617
Multiple SQL injection vulnerabilities in Tourism Script Accommodation Hotel Booking Portal Script allow remote attackers to execute arbitrary SQL commands via the hotel_id parameter to (1) hotel.php, (2) details.php, (3) roomtypes.php, (4) photos.php, (5) map.php, (6) weather.php, (7) reviews.php, and (8) book.php.
Vulnerability class: SQL Injection
EPSS: 0.010 (59.5th percentile) — read the EPSS interpretation.
Affected products
- Tourismscripts Tourism_script_accomodation_hotel_booking_portal_script
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (exploit, x_refsource_EXPLOIT-DB)