CVE-2024-9298: oretnom23 railway_reservation_system Improper Access Control

Vulnerability summary

CVE-2024-9298 is a medium (CVSS 5.3) Improper Access Control vulnerability in oretnom23 railway_reservation_system. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 40.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 28-09-2024
   PublishedVulnerability first disclosed.
2. 30-09-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability was found in SourceCodester Online Railway Reservation System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /?page=tickets of the component Ticket Handler. The manipulation of the argument id leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.