itsourcecode Event Management System SQL Injection Flaw Exposes Admin Data

Summary

A security issue in itsourcecode Event Management System 1.0 allows an attacker to access and manipulate sensitive admin data. This can happen if an attacker sends malicious input to the system, potentially exposing your business's private information. Update to the latest version of the system to protect your data.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
admerc	event_management_system	1.0	–

Original title

A vulnerability was detected in itsourcecode Event Management System 1.0. The affected element is an unknown function of the file /admin/index.php. Performing a manipulation of the argument ID resu...

Original description

A vulnerability was detected in itsourcecode Event Management System 1.0. The affected element is an unknown function of the file /admin/index.php. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.

nvd CVSS2.0 7.5

nvd CVSS3.1 9.8

nvd CVSS4.0 6.9

Vulnerability type

CWE-74 Injection

CWE-89 SQL Injection

https://github.com/ltranquility/cve_submit/issues/1 Exploit Issue Tracking Mitigation Third Party Advisory
https://itsourcecode.com/ Product
https://vuldb.com/?ctiid.347398 Permissions Required VDB Entry
https://vuldb.com/?id.347398 Third Party Advisory VDB Entry
https://vuldb.com/?submit.757226 Third Party Advisory VDB Entry