resortdata internet reservation module next generation - vulnerabilities and exploits

(subscribe to this query)

9.8

CVSSv3

The /irmdata/api/ endpoints exposed by the IRM Next Generation booking engine authenticates requests using HMAC tokens. These tokens are however exposed in a JavaScript file loaded on the client side, thus rendering this extra safety mechanism useless.

Resortdata Internet Reservation Module Next Generation -

9.1

CVSSv3

The RDPData.dll file exposes the /irmdata/api/common endpoint that handles session IDs, among other features. By using a UNION SQL operator, an attacker can leak the sessions table, obtain the currently valid sessions and impersonate a currently logged-in user.

Resortdata Internet Reservation Module Next Generation 5.3.2.15

8.8

CVSSv3

The RDPCore.dll component as used in the IRM Next Generation booking engine, allows a remote user to connect to customers with an "admin" account and a corresponding password computed daily by a routine inside the DLL file. Once reverse-engineered, this routine can help...

Resortdata Internet Reservation Module Next Generation 5.3.2.15

8.8

CVSSv3

A vulnerability in RDPngFileUpload.dll, as used in the IRM Next Generation booking system, allows a remote malicious user to upload arbitrary content (such as a web shell component) to the SQL database and execute it with SYSTEM privileges. This vulnerability requires authenticat...

Resortdata Internet Reservation Module Next Generation 5.3.2.15

7.7

CVSSv3

The RDPWin.dll component as used in the IRM Next Generation booking engine includes a set of hardcoded API keys for third-party services such as Twilio and Vonage. These keys allow unrestricted interaction with these services.

Resortdata Internet Reservation Module Next Generation 5.4.1.23

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook