CVE-2019-18414

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Sourcecodester Restaurant Management System 1.0 is affected by an admin/staff-exec.php Cross Site Request Forgery vulnerability due to a lack of CSRF protection. This could lead to an attacker tricking the administrator into executing arbitrary code or adding a staff entry via a crafted HTML page.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.sevenlayers.com/index.php/263-restaurant-management-system-csrfExploit, Third Party Advisory
https://www.sevenlayers.com/index.php/263-restaurant-management-system-csrfExploit, Third Party Advisory

Timeline

Published: Oct 24, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-184156.1Sourcecodester Restaurant Management System 1.0 allows XSS via the "send a message" screen.CVE-2019-184166.1Sourcecodester Restaurant Management System 1.0 allows XSS via the Last Name field of a member.CVE-2019-184178.8Sourcecodester Restaurant Management System 1.0 allows an authenticated attacker to upload arbitrary files that can result in code execution CVE-2019-184189.8clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests because there is no se CVE-2019-184196.1A cross-site scripting (XSS) vulnerability in index.php in ClonOS WEB control panel 19.09 allows remote attackers to inject arbitrary web sc CVE-2019-18425.4A vulnerability in the Secure Shell (SSH) authentication function of Cisco IOS XR Software could allow an authenticated, remote attacker to CVE-2019-184206.5An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via a VCPUOP_initialise hypercall.CVE-2019-184217.5An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging race conditions in pag CVE-2019-184228.8An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service or gain privileges by leveraging the CVE-2019-184238.8An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service via a XENMEM_add_to_physmap hypercall CVE-2019-184246.8An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted domain CVE-2019-184259.8An issue was discovered in Xen through 4.12.x allowing 32-bit PV guest OS users to gain guest OS privileges by installing and using descript