Threats tagged 'ghsa-522x-2462-3pxx'

A SQL injection vulnerability exists in FantasticLBP Hotels Server in the file controller/api/hotelList.php. The flaw involves manipulation of the subjectId or cityName arguments, allowing remote attackers to execute SQL injection. The product uses a rolling release model, so specific affected versions are not available. The vendor was contacted but did not respond. Public exploit code has been released. The CVSS score is 6.3, indicating a medium severity vulnerability.