itsourcecode Event Management System allows attackers to inject malicious SQL code

Summary

A security flaw in itsourcecode Event Management System's Admin Login feature allows hackers to inject malicious code, potentially giving them access to sensitive information. This could happen if an attacker uses a malicious username. To protect yourself, update to the latest version of the software or consider alternative solutions.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
admerc	event_management_system	1.0	–

Original title

A flaw has been found in itsourcecode Event Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ajax.php?action=login of the component Admin Login. ...

Original description

A flaw has been found in itsourcecode Event Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ajax.php?action=login of the component Admin Login. This manipulation of the argument Username causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.

nvd CVSS2.0 7.5

nvd CVSS3.1 9.8

nvd CVSS4.0 6.9

Vulnerability type

CWE-74 Injection

CWE-89 SQL Injection

https://github.com/ltranquility/CVE/issues/39 Exploit Issue Tracking Mitigation Third Party Advisory
https://itsourcecode.com/ Product
https://vuldb.com/?ctiid.346490 Permissions Required VDB Entry
https://vuldb.com/?id.346490 Third Party Advisory VDB Entry
https://vuldb.com/?submit.754239 Third Party Advisory VDB Entry