CVE-2022-3774
SourceCodester Train Scheduler App resource injection
CRITICAL 9.1EPSS 1.2%
A vulnerability was found in SourceCodester Train Scheduler App 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /train_scheduler_app/?action=delete. The manipulation of the argument id leads to improper control of resource identifiers. The attack may be launched remotely. The identifier of this vulnerability is VDB-212504.
- Affected
- SourceCodester · Train Scheduler App
- CVSS v3.1 NVD
- 9.1 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - CVSS v3.1 VULDB
- 5.4 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L - EPSS
- 1.24% chance of exploitation in the next 30 days, 69th percentile
- Published
- 2022-10-31
- Updated
- 2025-04-15
Proof-of-concept exploits (3)
- http://packetstormsecurity.com/files/169604/Train-Scheduler-App-1.0-Insecure-Direct-Objec…
- rohit0x5/poc/blob/main/idor0★ · 2023-11-01
- r0x5r/poc0★ · 2023-11-01