Two SQL injection sinks: the payments list builds its ORDER BY column from the request sort parameter with no allowlist, and the package-customer filter interpolates couponId straight into the WHERE clause. Fixed in 2.1.2. This vulnerability affects the following application versions: Amelia Booking 1.2.1 Amelia Booking 1.2.2 Amelia Booking 1.2.3... Weiterlesen: SQL Injection in Amelia Booking Payments Sort and Package Coupon Filter
Intelligence View
⚡ tsecurity.de Intelligence
SQL Injection in Amelia Booking Payments Sort and Package Coupon Filter
Two SQL injection sinks: the payments list builds its ORDER BY column from the request sort parameter with no allowlist, and the package-customer filter…
Vulnerabilities (CVE) Vulnerability definition feed 1 Min. Lesezeit TA0001 · T1190 Finanzwesen & Banking
Social ReaktionenReagiere als Erste:r — dein Feedback zählt!
🔍 CTI & Forensik
2
Cyber Threat Intelligence & Forensik
ATT&CK-Navigator · IoC-Radar · Exploit-Belege
MITRE ATT&CK Matrix Navigator
T1190TA0001 · Initial Access
Exploit Public-Facing Application
Mitigation: M1042 Network Segmentation & WAF Rule Enforcement
Quelle: Kontext-Klassifikation des Artikeltextes
Initial Access
CTI Threat Relationship Graph
Akteure · Techniken · Beziehungen
CVE / Incident Threat Actor Software MITRE ATT&CK CWE Weakness IoC
Powered by tsecurity.de
tsecurity.de Hub
Intelligence Digest — free The top security news daily · unsubscribe anytime
Community Rating & Social Proof
⭐ Leser-Wertung
–
Ø / 5.0
★★★★★
No reader ratings yet
Was this page helpful?
0
Powered by tsecurity.de
tsecurity.de Hub
Related story clusters & sources (vector AI)
17 sources
CVE-2026-68445 | Linux Kernel up to 7.2-rc4 vc4 vc4_gem_object_mmap privileges management (Nessus ID 334892 / WID-SEC-2026-2799)
16 more sources
VVulDB Updates2 hours agoCVE-2026-68453 | Linux Kernel up to 6.18.43/7.1.7/7.2-rc5 zcrypt cca_cipher2protkey buffer overflow VVulDB Updates2 hours agoCVE-2026-72200 | Linux Kernel ntfs integer overflow (EUVD-2026-58958) VVulDB Updates2 hours agoCVE-2026-68471 | Linux Kernel up to 6.18.39/7.1.4/7.2-rc3 Wifi Ieee80211 Mle ieee80211_mle_size_ok input validation (WID-SEC-2026-2852) VVulDB Updates2 hours agoCVE-2026-72203 | Linux Kernel up to 7.1.4 NTFS attrib.c ntfs_mft_writepages deadlock (EUVD-2026-58961) VVulDB Updates2 hours agoCVE-2026-72198 | Linux Kernel up to 7.1.4 ntfs dir.c ntfs_inode_sync_standard_information non_resident improper synchronization (EUVD-2026-58956) VVulDB Updates2 hours agoCVE-2026-72130 | Linux Kernel up to 6.12.100/6.18.39/7.1.4 nvmet-auth nvmet_execute_auth_receive out-of-bounds write (Nessus ID 342234)
+10
10 sources
CVE-2026-62902 | Microsoft .NET/Visual Studio improper authorization (EUVD-2026-56410 / WID-SEC-2026-2761)
9 more sources
VVulDB Updates2 hours agoCVE-2026-62899 | Microsoft .NET/Visual Studio improper authorization (Nessus ID 335252 / WID-SEC-2026-2761) VVulDB Updates2 hours agoCVE-2026-73608 | Siyuan Note SiYuan up to 3.7.3 getAttributeViewSearchTarget improper authorization VVulDB Updates2 hours agoCVE-2026-70354 | Microsoft .NET/Visual Studio out-of-bounds write (EUVD-2026-56770 / Nessus ID 341336) VVulDB Updates2 hours agoCVE-2026-62909 | Microsoft .NET/Visual Studio privileges management (EUVD-2026-56412 / Nessus ID 335447) VVulDB Updates2 hours agoCVE-2026-62901 | Microsoft .NET/Visual Studio infinite loop (EUVD-2026-56409 / Nessus ID 335447) VVulDB Updates6 hours agoCVE-2026-62897 | Microsoft .NET/.NET Framework/Visual Studio integer overflow (WID-SEC-2026-2761)
+3
10 sources
FBI: Nordkorea steckt hinter Milliarden-Kryptodiebstahl bei Binance
9 more sources
Hheise online News4 hours agoFBI: Nordkorea steckt hinter Milliarden-Kryptodiebstahl bei Binance GGoogle Alert4 hours agoBinance: Kryptobörse nimmt nach Milliarden-Raub Auszahlungen wieder auf GGoogle Alert3 hours agoBinance nach Rekord-Diebstahl: Hacker erbeuten 6,3 Milliarden Dollar – was jetzt passiert GGoogle Alert14 hours agoHacker erbeuteten 6,3 Milliarden Dollar von der Kryptowährungsbörse Binance: GGoogle Alert10 hours agoFBI vermutet nordkoreanische Hacker hinter Angriff auf "Binance" | BR24 GGoogle Alert8 hours agoFBI bestätigt: Nordkorea steckt hinter milliardenschwerem Krypto-Diebstahl bei Binance
+3
Mehr aus dieser Kategorie
Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen
HAND-OFF
Auf Smartphone übergeben (ADVISORY)
Scannen Sie den QR-Code mit der Smartphone-Kamera für sofortigen mobilen Zugriff:
https://tsecurity.de/en/4307810/vulnerabilities-cve/sql-injection-in-amelia-booking-payments-sort-and-package-coupon-filter/